diff --git a/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/encryption/EncryptionController.java b/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/encryption/EncryptionController.java
index 63657c8c..c90facef 100644
--- a/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/encryption/EncryptionController.java
+++ b/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/encryption/EncryptionController.java
@@ -129,8 +129,9 @@ public class EncryptionController {
 			String input = stripFormData(data, type, false);
 			Map<String, String> keys = this.helper.getEncryptorKeys(name, profiles,
 					input);
+			String textToEncrypt = this.helper.stripPrefix(input);
 			String encrypted = this.helper.addPrefix(keys,
-					this.encryptor.locate(keys).encrypt(input));
+					this.encryptor.locate(keys).encrypt(textToEncrypt));
 			logger.info("Encrypted data");
 			return encrypted;
 		}
@@ -156,7 +157,7 @@ public class EncryptionController {
 					profiles, input);
 			TextEncryptor encryptor = this.encryptor.locate(encryptorKeys);
 			String encryptedText = this.helper.stripPrefix(input);
-			String decrypted = this.helper.stripPrefix(encryptor.decrypt(encryptedText));
+			String decrypted = encryptor.decrypt(encryptedText);
 			logger.info("Decrypted cipher data");
 			return decrypted;
 		}
diff --git a/spring-cloud-config-server/src/test/java/org/springframework/cloud/config/server/encryption/EncryptionControllerTests.java b/spring-cloud-config-server/src/test/java/org/springframework/cloud/config/server/encryption/EncryptionControllerTests.java
index 488bce9d..cc0c7797 100644
--- a/spring-cloud-config-server/src/test/java/org/springframework/cloud/config/server/encryption/EncryptionControllerTests.java
+++ b/spring-cloud-config-server/src/test/java/org/springframework/cloud/config/server/encryption/EncryptionControllerTests.java
@@ -15,13 +15,22 @@
  */
 package org.springframework.cloud.config.server.encryption;
 
+import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.not;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertThat;
 import static org.junit.Assert.assertTrue;
+import static org.mockito.Matchers.anyString;
+import static org.mockito.Mockito.atLeastOnce;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
 
 import java.util.Map;
 
 import org.junit.Test;
+import org.mockito.ArgumentCaptor;
 import org.springframework.http.MediaType;
 import org.springframework.security.crypto.encrypt.Encryptors;
 import org.springframework.security.crypto.encrypt.TextEncryptor;
@@ -98,6 +107,19 @@ public class EncryptionControllerTests {
 		assertEquals("Wrong decrypted plaintext: " + decrypt, "foo bar", decrypt);
 	}
 
+	@Test
+	public void prefixStrippedBeforeEncrypt() {
+		TextEncryptor encryptor = mock(TextEncryptor.class);
+		when(encryptor.encrypt(anyString())).thenReturn("myEncryptedValue");
+
+		this.controller = new EncryptionController(new SingleTextEncryptorLocator(encryptor));
+		this.controller.encrypt("{key:test}foo", MediaType.TEXT_PLAIN);
+
+		ArgumentCaptor<String> captor = ArgumentCaptor.forClass(String.class);
+		verify(encryptor, atLeastOnce()).encrypt(captor.capture());
+		assertThat("Prefix must be stripped prior to encrypt", captor.getValue(), not(containsString("{key:test}")));
+	}
+
 	@Test
 	public void addEnvironment() {
 		TextEncryptorLocator locator = new TextEncryptorLocator() {