The API is designed to create the SHA1 signature (as you can see in the code you are referring to). The purpose of this should not be reversible (unsigned), but should be used as authentication.
For example, if you signed an authentication token, you can verify that it was not tampered with by checking that Crypto.sign(token) == tokenSignature
.
If you want to encrypt and decrypt, check Crypto.encryptAES
/ Crypto.decryptAES
(added in Play 2.1).
source share