@rahulxsh/secure-client

Browser hybrid encryption (RSA-OAEP + AES-256-GCM) using the WebCrypto API. Encrypt data in the browser so only your server can read it.

Install

npm install @rahulxsh/secure-client @rahulxsh/secure-core

Quick example (RSA)

import {
  encryptRequest,
  decryptResponse,
  generateEphemeralKeyPair,
  exportPublicKeySpki,
  importRsaPublicKey,
  importRsaPrivateKey,
} from "@rahulxsh/secure-client";

// 1. Server: generate key pair once (or use your existing RSA key)
const keyPair = await generateEphemeralKeyPair();
const publicKeyPem = await exportPublicKeySpki(keyPair.publicKey);
// Send publicKeyPem to the client (e.g. via your API or config).

// 2. Client: encrypt request with server's public key
const serverPublicKey = await importRsaPublicKey(publicKeyPem);
const encrypted = await encryptRequest(
  { userId: "123", action: "submit" },
  serverPublicKey,
  "key-v1"
);
// POST encrypted to your API.

// 3. Client: decrypt encrypted response from server (using your client key pair)
const responseData = await decryptResponse(encryptedResponseFromServer, yourClientKeyPair.privateKey);

ECDH and X25519

Same pattern with different functions:

import {
  generateEcdhKeyPair,
  encryptRequestEcdh,
  decryptResponseEcdh,
} from "@rahulxsh/secure-client";

const ecdhPair = await generateEcdhKeyPair();
const encrypted = await encryptRequestEcdh(data, serverEcdhPublicKey, "ecdh-v1");
const decrypted = await decryptResponseEcdh(encryptedResponse, ecdhPair.privateKey);

import {
  generateX25519KeyPair,
  encryptRequestX25519,
  decryptResponseX25519,
} from "@rahulxsh/secure-client";

const x25519Pair = await generateX25519KeyPair();
const encrypted = await encryptRequestX25519(data, serverX25519PublicKey, "x25519-v1");
const decrypted = await decryptResponseX25519(encryptedResponse, x25519Pair.privateKey);

Algorithms

| Algorithm | Key exchange | Use when | |-----------------------|----------------|------------------------| | RSA-OAEP-AES-256-GCM | RSA public key | Simple client→server | | ECDH-AES-256-GCM | P-256 | Forward secrecy | | X25519-AES-256-GCM | X25519 | Forward secrecy |

License

MIT