API Overview
Everything is exported from the single entry point @ppabari/encryptix. Most functionality lives on the EncryptixClient; a set of standalone helpers is exported for key generation, encoding, OTP, and randomness.
import { EncryptixClient, generateMasterKey } from '@ppabari/encryptix';
const enc = new EncryptixClient();
Client methods
| Method | Description |
|---|---|
encrypt(plaintext, purpose, opts?) |
AES-GCM or ChaCha20 encrypt → Symmetric |
decrypt(payload, purpose, opts?) |
Symmetric decrypt |
encryptObject(value, purpose, opts?) |
Encrypt any JSON value with optional TTL |
decryptObject(payload, purpose, opts?) |
Decrypt and verify TTL automatically |
encryptDeterministic(plaintext, purpose, opts?) |
AES-SIV deterministic encrypt → Deterministic |
decryptDeterministic(payload, purpose, opts?) |
AES-SIV decrypt + verify |
envelopeEncrypt(plaintext, purpose, opts?) |
DEK/KEK envelope encrypt → Envelope |
envelopeDecrypt(envelope, purpose, opts?) |
Unwrap DEK, decrypt data |
multiRecipientEncrypt(plaintext, recipients, opts?) |
Encrypt for many public keys |
addRecipient(...) / removeRecipient(...) |
Manage recipients of an envelope |
sign(payload, purpose, opts?) |
HMAC-SHA256 signed token → Signed Tokens |
verify(token, purpose, opts?) |
Verify signed token → VerifyTokenResult |
encryptStream(opts) / decryptStream(opts) |
TransformStream chunk encryption → Streaming |
encryptBatch / decryptBatch / *Mixed / *Safe |
Bulk operations → Batch |
encryptRSA / decryptRSA / generateRSAKeyPair |
RSA-OAEP → Asymmetric |
signRSA / verifyRSA / generateRSAPSSKeyPair |
RSA-PSS signatures |
generateECDHKeyPair / generateECDSAKeyPair / signECDSA / verifyECDSA |
Elliptic-curve keys & signatures |
deriveKeyFromPassword(pass, purpose, opts?) |
scrypt/PBKDF2 password → keyHex → Password KDF |
generateTOTP / verifyTOTP / generateHOTP / totpKeyUri |
OTP → OTP |
hash / hmac / verifyHmac |
Hashing & HMAC → Utilities |
generateToken / generateApiKey / generateUUID |
Random tokens & IDs |
keyFingerprint() |
Short non-reversible key identifier → Key Management |
rotate(newKeyHex) |
Key rotation → new EncryptixClient |
inspectPayload(payload) |
Decode a payload header without the key |
Standalone exports
| Group | Exports |
|---|---|
| Keys | generateMasterKey, generateRSAKeyPair, generateRSAPSSKeyPair, generateECDHKeyPair, generateECDSAKeyPair |
| Asymmetric | rsaEncrypt, rsaDecrypt, rsaPssSign, rsaPssVerify, deriveSharedSecret, ecdsaSign, ecdsaVerify |
| OTP | generateTOTPSecret, generateTOTP, verifyTOTP, generateHOTP, totpKeyUri, toBase32, fromBase32 |
| Multi-recipient | multiRecipientEncrypt, multiRecipientDecrypt, addRecipient, removeRecipient |
| Tokens & hashing | hash, hmac, verifyHmac, generateToken, generateApiKey, generateUUID |
| Secure random | secureRandomBytes, secureRandomInt, secureRandomFloat, secureRandomString, secureRandomChoice, secureRandomSample, secureRandomShuffle, securePassphrase, CHARSETS |
| Batch | encryptBatch, decryptBatch, encryptBatchMixed, decryptBatchMixed, encryptBatchSafe, decryptBatchSafe |
| Encoding | base32Encode/Decode, hexEncode/Decode, base64Encode/Decode, base64urlEncode, convertEncoding, safeCompare |
| Inspection | inspectPayload, inspectStreamHeader, inspectToken |
| Key management | zeroize, zeroizeAll, withZeroize, createKeyMetadataStore, reEncrypt, reEncryptBatch, exportKeyToJWK, importKeyFromJWK, serializeKey, deserializeKey |
| KDF | deriveKeyFromPassword |
| Errors | EncryptixError |
🧭
New here? Start with the Getting Started guide and Core Concepts (purpose scoping), then dive into the capability pages in the sidebar.