Symmetric Encryption

Authenticated encryption with AES-256-GCM (default, works everywhere) or ChaCha20-Poly1305 (Node.js). Every operation is purpose-scoped.

encrypt / decrypt

// AES-256-GCM (default — works everywhere)
const payload = await enc.encrypt('secret', 'my:purpose');
const plain   = await enc.decrypt(payload, 'my:purpose');

// ChaCha20-Poly1305 (Node.js only)
const enc2 = new EncryptixClient({ algorithm: 'chacha20-poly1305' });
const payload2 = await enc2.encrypt('secret', 'my:purpose');

encrypt(plaintext: string, purpose: string, options?: EncryptOptions): Promise<string>
decrypt(payload: string, purpose: string, options?: DecryptOptions): Promise<string>

Additional authenticated data (AAD)

Bind a ciphertext to a specific user, request, or tenant. The same aad must be supplied on decrypt or it fails.

const payload = await enc.encrypt('data', 'auth:token', { aad: userId });
await enc.decrypt(payload, 'auth:token', { aad: userId });

Time-to-live (TTL)

The expiry is embedded in the AAD, so it cannot be stripped without breaking authentication.

// Payload auto-expires after N seconds
const payload = await enc.encrypt('data', 'auth:token', { ttlSeconds: 3600 });

Object encryption

Encrypts any JSON-serializable value. Expiry is embedded inside the ciphertext and verified transparently on decrypt — no extra parameters needed.

const payload = await enc.encryptObject(
  { userId: '123', role: 'admin' },
  'user:session',
  { ttlSeconds: 3600 }
);

// Decrypts AND checks expiry automatically
const session = await enc.decryptObject<{ userId: string; role: string }>(
  payload,
  'user:session'
);
// Throws EncryptixError { code: 'PAYLOAD_EXPIRED' } if expired

encryptObject<T>(value: T, purpose: string, options?: EncryptObjectOptions): Promise<string>
decryptObject<T>(payload: string, purpose: string, options?: DecryptObjectOptions): Promise<T>

ℹ️

Both ciphers are AEAD — a tampered payload, wrong key, or wrong purpose always throws DECRYPTION_FAILED. See Error Handling.