@redenv/e2ee

A Zero-Knowledge, End-to-End Encryption (E2EE) library based purely on the Universal Web Crypto API.

Perfect for applications where the frontend encrypts sensitive user data (like passwords, notes, or secrets) and the backend simply stores the encrypted blobs and metadata without actually knowing the plaintext.

It implements the classical Envelope Encryption Pattern.

Installation

bun add @redenv/e2ee

npm install @redenv/e2ee

Features

• Zero dependencies (uses native Web Crypto).
• Universal: Works across browsers, Node.js, Deno, and Bun.
• Secure Default Standards: AES-256-GCM and PBKDF2 with 310,000 iterations.

Usage

1. User Setup

When a user sets up their account and provides a master password.

import { Vault } from "@redenv/e2ee";

// Create a new vault from the master password
const vault = await Vault.create("my-secure-master-password");

// Export the metadata to save to your database
// Provide this back to the user when they need to log in
const metadata = vault.exportMetadata();
/*
  {
    salt: '...',
    encryptedMasterKey: '...'
  }
*/

2. User Login & Decryption

When a user logs in, retrieve their metadata from the DB.

import { Vault } from "@redenv/e2ee";

// Unlock the vault using their password and the DB metadata
const vault = await Vault.unlock("my-secure-master-password", metadata);

// Encrypt some data in the browser BEFORE sending it to the DB
const encryptedBlob = await vault.encrypt("My highly sensitive document text");

// ... later ...

// Decrypt data that came from the DB
const plaintext = await vault.decrypt(encryptedBlob);

3. Encrypting Binary Files (Images, PDFs, etc.)

Because converting large files to strings is slow, there are dedicated methods for Uint8Array binary buffers.

// E.g., handling a file upload in the browser
const fileInput = document.getElementById("filePicker").files[0];
const arrayBuffer = await fileInput.arrayBuffer();
const binaryData = new Uint8Array(arrayBuffer);

// Encrypt the file as a buffer
const encryptedBuffer = await vault.encryptBuffer(binaryData);

// Save `encryptedBuffer` to your DB as a Blob/Binary type