mdflow-crypt

Encrypt and decrypt MDflow documents locally, from the command line.

MDflow lets you encrypt a document's body in your browser; the server only ever stores ciphertext (mdflow-enc:v1:…). This tool does the same crypto on your own machine, so you can take an encrypted document out of MDflow and read or write it offline — your plaintext and your password never leave your computer, and never go to a server or an AI model.

Zero dependencies. One file. Works on Node ≥ 18.

Usage

# decrypt: mdflow-enc:v1 file  →  <name>_decrypted.md
npx mdflow-crypt decrypt notes.md

# encrypt: markdown file  →  <name>_encrypted.md  (paste the result into MDflow)
npx mdflow-crypt encrypt notes.md

# password from a file (first line; keep it chmod 600) instead of the prompt
npx mdflow-crypt encrypt notes.md --password-file ~/.secrets/notes.pw

Password — resolved in this order (first match wins):

1. --password <pw> — an inline flag
2. --password-file <path> — read from a file (the first line; spaces preserved, a trailing newline ignored)
3. the [password] positional argument
4. otherwise you're prompted (hidden; encrypt asks twice to confirm)

--password and the positional argument are visible to other processes and land in your shell history — for anything sensitive prefer the hidden prompt or a chmod 600 --password-file.

The output file is written next to the input, with the original extension dropped:

| Command | report.md → | |---|---| | encrypt | report_encrypted.md | | decrypt | report_decrypted.md |

Install it as a permanent command instead of using npx:

npm install -g mdflow-crypt
mdflow-crypt encrypt notes.md

Behavior

• decrypt requires an mdflow-enc: file; a wrong password or corrupted data exits non-zero and writes nothing.
• encrypt refuses a file that is already encrypted, and asks for the password twice (there is no recovery — a forgotten password means the document is unrecoverable; store it in a password manager).
• Exit codes: 0 ok · 1 usage / unreadable / wrong-shape input · 2 no or mismatched password · 3 decrypt failed.

Security notes

• This is a local tool by design. The point is that decrypting never exposes your content to a server or a model — so don't pipe it through a remote runner; install it (or npx) and run it on your own machine.
• For a security tool, pin a version you trust — npx [email protected] … — rather than always pulling the latest.
• There is no password recovery and no backdoor. The format is PBKDF2-HMAC-SHA256 (600k iterations) → AES-256-GCM, matching MDflow's in-browser encryption exactly.

License

MIT