secbyte

Encrypt or decrypt files with compression from the command line or from Node.js.

CLI usage

[SECBYTEPASS=yourPassword] npx secbyte enc|encrypt|dec|decrypt [options] [inputPattern...]
[SECBYTEPASS=yourPassword] npx secbyte enc|encrypt|dec|decrypt --include <pattern> [--exclude <pattern>] [options]

At least one positional input pattern or --include option is required. Positional patterns and repeatable --include options are combined. Repeatable --exclude options remove matches from that combined input. Files matched by overlapping patterns are processed once, preserving their first occurrence.

Quote option glob patterns so the shell passes them unchanged to SecByte.

# Existing positional syntax remains supported.
npx secbyte enc **/* --delete --overwrite

# Include all files recursively except exported eyJl text files.
npx secbyte enc --include='**/*' --exclude='**/*.eyJl.txt' --delete --overwrite

• The -p, --password option takes precedence; SECBYTEPASS is used only when no password flag is provided.
• If neither is set, the tool prompts for a password.

Node.js library API

The package includes TypeScript declarations for the public API.

import {
  decryptBuffer,
  decryptBufferWithMetadata,
  decryptStream,
  encryptBuffer,
  encryptStream,
} from "secbyte";

Buffers

const encrypted = await encryptBuffer(inputBuffer, password);
const decrypted = await decryptBuffer(encrypted, password);

To retrieve the timestamps stored in a SecByte payload without writing a temporary file:

const {
  data,
  createdAt,
  modifiedAt,
} = await decryptBufferWithMetadata(encrypted, password);

const reencrypted = await encryptBuffer(data, password, {
  createdAt,
  modifiedAt: new Date(),
});

Streams

await encryptStream(inputReadable, outputWritable, password, {
  createdAt,
  modifiedAt,
});

const metadata = await decryptStream(
  encryptedReadable,
  outputWritable,
  password,
);

decryptStream() returns the stored createdAt and modifiedAt values.

Payloads produced through the Node.js API use the same SecByte format as the CLI. Files encrypted by either interface can be decrypted by the other.