Crypstie

Create and open end-to-end encrypted Crypstie links from Node.js or a shell. The plaintext and the 256-bit key never reach the Crypstie server: it stores only an authenticated ciphertext, while the key stays in the URL fragment.

Compatible with links created by the original Kotlin/JS client at crypstie.com. No Kotlin runtime is required.

Install

npm install crypstie

For global CLI use:

npm install --global crypstie

Requires Node.js 18 or newer.

CLI

Create a reusable link from stdin or a file:

printf 'secret text' | crypstie create
crypstie create ./document.txt --days 7

Create a burn-on-read link:

crypstie create ./secret.txt --burn

Open a link. Quote it so the shell does not interpret #:

crypstie open 'https://crypstie.com/_id#key'
crypstie open "$CRYPSTIE_URL" --output ./document.bin
crypstie open "$CRYPSTIE_URL" --json

put/encrypt and get/decrypt are aliases for create and open.

Node.js API

const { createCrypstie, openCrypstie } = require('crypstie');

const created = await createCrypstie('secret text', {
  burnOnShow: false,
  deleteAt: new Date(Date.now() + 7 * 86400_000),
});
console.log(created.url);

const opened = await openCrypstie(created.url);
console.log(opened.text); // UTF-8 convenience view
console.log(opened.data); // Uint8Array with exact bytes

Both functions accept an optional fetch implementation and AbortSignal. createCrypstie also accepts rootUrl, UI metadata fields, and binary input. openCrypstie accepts optional profileIds for compatibility with owner-aware legacy links.

Security model

• Encryption is local AES-256-CTR with Encrypt-then-Authenticate and SHA-256-based HMAC, implemented by unicrypto.
• The encrypted record uses the BOSS wire format.
• The URL fragment is removed locally and is never included in the HTTP request.
• Anyone possessing the complete URL can decrypt the content. Treat the URL as a secret and avoid placing it in logs.
• --burn is enforced by the server. Concurrent first reads are subject to the guarantees of the deployed server implementation.

AI agents

The npm package includes a compact skill at skills/crypstie/SKILL.md. Point an agent's skill loader at that directory, or copy the skills/crypstie folder into its skills directory. The skill uses the CLI and keeps secret links out of its written responses whenever possible.

After a local install, the skill is available at:

node_modules/crypstie/skills/crypstie

The canonical public copy and its SHA-256 discovery metadata are available at https://crypstie.com/.well-known/agent-skills/index.json. Maintainers can run npm run deploy to test the package, publish an unpublished package version, and atomically update the public skill. Use -- --npm-only or -- --skills-only to deploy just one part.

Development

npm ci
npm test
npm pack --dry-run

Live read compatibility test:

CRYPSTIE_TEST_URL='https://crypstie.com/_id#key' npm test

Live create/read test (writes one expiring test record):

CRYPSTIE_LIVE_WRITE=1 npm test

Russian documentation: docs/README.ru.md.

Source code and issues: SergeychWorks/crypstie3-node.

Authors

• sergeych — Crypstie protocol, service, and original implementations
• Codex (OpenAI) — Node.js module, CLI, tests, and agent skill