The Org Manual: org-crypt

Org crypt encrypts the text of an Org entry, but not the headline, or properties. Org crypt uses the Emacs EasyPG library to encrypt and decrypt.

Any text below a headline that has a ‘:crypt:’ tag will be automatically be encrypted when the file is saved. To use a different tag, customize the org-crypt-tag-matcher variable.

(require 'org-crypt)
(org-crypt-use-before-save-magic)
(setq org-tags-exclude-from-inheritance (quote ("crypt")))

(setq org-crypt-key nil)
  ;; GPG key to use for encryption
  ;; Either the Key ID or set to nil to use symmetric encryption.

(setq auto-save-default nil)
  ;; Auto-saving does not cooperate with org-crypt.el: so you need
  ;; to turn it off if you plan to use org-crypt.el quite often.
  ;; Otherwise, you'll get an (annoying) message each time you
  ;; start Org.

  ;; To turn it off only locally, you can insert this:
  ;;
  ;; # -*- buffer-auto-save-file-name: nil; -*-

Excluding the crypt tag from inheritance prevents encrypting previously encrypted text.

15.11 org-crypt.el