diff --git a/services/sync/modules/base_records/crypto.js b/services/sync/modules/base_records/crypto.js
index a831564411ec..1d8d6edfa77c 100644
--- a/services/sync/modules/base_records/crypto.js
+++ b/services/sync/modules/base_records/crypto.js
@@ -70,17 +70,30 @@ CryptoWrapper.prototype = {
     // FIXME: this will add a json filter, meaning our payloads will be json
     //        encoded, even though they are already a string
     this._WBORec_init(uri, authenticator);
-    this.data.encryption = "";
-    this.data.payload = "";
+    this.data.payload = {
+      encryption: "",
+      cleartext: null,
+      ciphertext: null
+    };
   },
 
   // FIXME: we make no attempt to ensure cleartext is in sync
   //        with the encrypted payload
   cleartext: null,
 
-  get encryption() this.data.encryption,
+  get encryption() this.payload.encryption,
   set encryption(value) {
-    this.data.encryption = value;
+    this.payload.encryption = value;
+  },
+
+  get cleartext() this.payload.cleartext,
+  set cleartext(value) {
+    this.payload.cleartext = value;
+  },
+
+  get ciphertext() this.payload.ciphertext,
+  set ciphertext(value) {
+    this.payload.ciphertext = value;
   },
 
   _encrypt: function CryptoWrap__encrypt(passphrase) {
@@ -92,9 +105,7 @@ CryptoWrapper.prototype = {
     let meta = yield CryptoMetas.get(self.cb, this.encryption);
     let symkey = yield meta.getKey(self.cb, privkey, passphrase);
 
-    // note: we wrap the cleartext payload in an array because
-    // when it's a simple string nsIJSON returns null
-    this.payload = crypto.encrypt(json.encode([this.cleartext]), symkey, meta.bulkIV);
+    this.ciphertext = crypto.encrypt(json.encode([this.cleartext]), symkey, meta.bulkIV);
 
     self.done();
   },
@@ -112,7 +123,7 @@ CryptoWrapper.prototype = {
     let symkey = yield meta.getKey(self.cb, privkey, passphrase);
 
     // note: payload is wrapped in an array, see _encrypt
-    this.cleartext = json.decode(crypto.decrypt(this.payload, symkey, meta.bulkIV))[0];
+    this.cleartext = json.decode(crypto.decrypt(this.ciphertext, symkey, meta.bulkIV))[0];
 
     self.done(this.cleartext);
   },
diff --git a/services/sync/modules/base_records/wbo.js b/services/sync/modules/base_records/wbo.js
index 849508810c9b..6b5ed1969262 100644
--- a/services/sync/modules/base_records/wbo.js
+++ b/services/sync/modules/base_records/wbo.js
@@ -59,7 +59,6 @@ WBORecord.prototype = {
     this.pushFilter(new WBOFilter());
     this.pushFilter(new JsonFilter());
     this.data = {
-      // modified: "2454725.98283", // FIXME
       payload: {}
     };
   },
@@ -82,18 +81,10 @@ WBORecord.prototype = {
     this.data.modified = value;
   },
 
-  get encoding() this.data.encoding,
-  set encoding(value) {
-    this.data.encoding = value;
-  },
-
   get payload() this.data.payload,
   set payload(value) {
     this.data.payload = value;
   }
-
-  // note: encryption is part of the CryptoWrapper object, which uses
-  // a string (encrypted) payload instead of an object
 };
 
 // fixme: global, ugh
@@ -105,14 +96,14 @@ WBOFilter.prototype = {
     let self = yield;
     let foo = wbo.uri.spec.split('/');
     data.id = decodeURI(foo[foo.length-1]);
-    data.payload = json.encode([data.payload]);
+    data.payload = json.encode(data.payload);
     self.done(data);
   },
   afterGET: function(data, wbo) {
     let self = yield;
     let foo = wbo.uri.spec.split('/');
     data.id = decodeURI(foo[foo.length-1]);
-    data.payload = json.decode(data.payload)[0];
+    data.payload = json.decode(data.payload);
     self.done(data);
   }
 };