diff --git a/graylog2-server/src/main/java/org/graylog2/security/encryption/EncryptedValueService.java b/graylog2-server/src/main/java/org/graylog2/security/encryption/EncryptedValueService.java
index <HASH>..<HASH> 100644
--- a/graylog2-server/src/main/java/org/graylog2/security/encryption/EncryptedValueService.java
+++ b/graylog2-server/src/main/java/org/graylog2/security/encryption/EncryptedValueService.java
@@ -18,6 +18,7 @@ package org.graylog2.security.encryption;
 
 import org.graylog2.security.AESTools;
 
+import javax.annotation.Nullable;
 import javax.inject.Inject;
 import javax.inject.Named;
 import javax.inject.Singleton;
@@ -48,7 +49,11 @@ public class EncryptedValueService {
                 .build();
     }
 
+    @Nullable
     public String decrypt(EncryptedValue encryptedValue) {
+        if (!encryptedValue.isSet()) {
+            return null;
+        }
         return AESTools.decrypt(encryptedValue.value(), encryptionKey, encryptedValue.salt());
     }
 }
Return null when no encryptedValue is set (#<I>)