@tsmx/string-crypto

Easily encrypt and decrypt strings.

Encryption is done with AES-256-GCM by default including authentication tag for tamper-safety.

You can also use AES-256-CBC for backward compatibility by specifying it on the encryption options. Decryption automatically detects the encryption algorithm and decrypts accordingly.

Note: AES-256-CBC does only provide encryption without any data integrity check. Add a MAC/integrity-check yourself if needed.

Usage

Key passed via environment variable

const sc = require('@tsmx/string-crypto');

let mySecret = 'My secret string';

let encrypted = sc.encrypt(mySecret);
// '28bedae6f6497f68abe403fb88df340e|2071d6458...'

let decrypted = sc.decrypt(encrypted); 
// 'My secret string'

Key passed directly via options

const sc = require('@tsmx/string-crypto');

let mySecret = 'My secret string';

let encrypted = sc.encrypt(mySecret, { key: '0123456789qwertzuiopasdfghjklyxc' });
// 'ba7bbb57674a198ad6cb7ff65801f9c9|a49cff4c9...'

let decrypted = sc.decrypt(encrypted, { key: '0123456789qwertzuiopasdfghjklyxc' }); 
// 'My secret string'

API

encrypt(value, options = null)

Encrypts value and returns the encrypted string. The key for encryption is taken from options.key or the environment variable ENCRYPTION_KEY if no options are present.

value

Type: String

The string that should be encrypted.

options

Type: Object Default: null

Object containing the supported options for encryption. Please also refer to the notes.

options = {
    key: 'YOUR KEY HERE',
    algorithm: 'aes-256-gcm',
    passNull: false
};

options.key

Type: String Default: null

The key used for encryption. If not present, the key is retrieved from the environment variable ENCRYPTION_KEY.

options.algorithm

Type: String Default: 'aes-256-gcm'

The encryption algorithm to use. Supported values are 'aes-256-gcm' (default) and 'aes-256-cbc'. Use 'aes-256-cbc' only for backward compatibility.

sc.encrypt(mySecret); // uses AES-256-GCM by default
sc.encrypt(mySecret, { algorithm: 'aes-256-cbc' }); // use AES-256-CBC explicitly

options.passNull

Type: Boolean Default: false

Sometimes it is helpful to let a value of null pass the encryption though null can't be encrypted either. If set to true the encrypt function will return null if value is null. Defaults to false, then an exception is thrown if the passed value is null.

sc.encrypt(null); // throwing Error
sc.encrypt(null,  { passNull: true }); // null

decrypt(value, options = null)

Decrypts value and returns the decrypted string. The key for decryption is taken from options.key or the environment variable ENCRYPTION_KEY if no options are present.

value

Type: String

The string that should be decrypted. Must be in the form that encrypt puts out.

options

Type: Object Default: null

Object containing the supported options for decryption. Please also refer to the notes.

options = {
    key: 'YOUR KEY HERE',
    passNull: false
};

options.key

Type: String Default: null

The key used for decryption. If not present, the key is retrieved from the environment variable ENCRYPTION_KEY.

options.passNull

Type: Boolean Default: false

Sometimes it is helpful to let a value of null pass the decryption though null can't be decrypted either. If set to true the decrypt function will return null if value is null. Defaults to false, then an exception is thrown if the passed value is null.

sc.decrypt(null); // throwing Error
sc.decrypt(null,  { passNull: true }); // null

Notes

Simple helper package to encrypt and decrypt strings using standard Node.js Crypto functions.

Algorithm & IV

| Property | Detail | |---|---| | Supported ciphers | AES-256-GCM (default), AES-256-CBC | | IV generation | crypto.randomBytes via crypto.createCipheriv |

Key

• Must be 32 bytes in one of two formats:
  • Plain string — exactly 32 characters
  • Hex string — exactly 64 characters (= 32 bytes)
• If options.key is not set, the key is read from the ENCRYPTION_KEY environment variable.

Encrypted output format

A |-delimited string:

| Algorithm | Format | |---|---| | AES-256-GCM | IV\|cipherText\|authTag | | AES-256-CBC | IV\|cipherText |

| Term | Description | |---|---| | IV | Initialization vector — a random value ensuring each encryption is unique | | cipherText | The encrypted payload | | authTag | Authentication tag (GCM only) — verifies the ciphertext has not been tampered with |

Upgrading from previous versions prior to 2.0.0

If you are upgrading from a version prior to 2.0.0 where only AES-256-CBC was available, note that the default encryption algorithm is now AES-256-GCM. To retain backwards compatibility, set the algorithm explicitly on every encrypt call:

// Before 2.0.0 (implicit CBC)
sc.encrypt(mySecret);

// From 2.0.0 on (explicit CBC for backwards compatibility)
sc.encrypt(mySecret, { algorithm: 'aes-256-cbc' });

Decryption requires no changes — it automatically detects the algorithm from the encrypted string.