Legacy compatibility: Blowfish does not authenticate ciphertext. Prefer modern authenticated encryption for new sensitive data. CBC prepends a random IV; choose the same ciphertext format when decrypting.