yamakawa

yamakawa is a tiny Unix-style CLI for encrypting text or arbitrary bytes with a shared passphrase. It is meant for copy-and-paste friendly encrypted messages in places like chats, email, or gists.

It requires Node.js 22 or newer and uses only Node.js standard modules at runtime: scrypt for key derivation and AES-256-GCM for authenticated encryption.

Install

npm install -g yamakawa

Encrypt And Decrypt

printf 'hello' | yamakawa > encrypted.txt
yamakawa -d encrypted.txt
cat encrypted.txt   # hello

yamakawa secret.txt -o secret.yamakawa
yamakawa -d secret.yamakawa -o secret.txt

Use - or omit the input file to read from standard input. Omit --output to write the encrypted message or decrypted bytes to standard output.

printf 'hello' |
  yamakawa --passphrase-file ./passphrase.txt |
  yamakawa --decrypt --passphrase-file ./passphrase.txt

Passphrases

By default, yamakawa prompts on the terminal without echoing the passphrase. Encryption asks for confirmation; decryption does not.

Automation can use one of these options:

yamakawa secret.txt --passphrase-file ./passphrase.txt
YAMAKAWA_PASSPHRASE='shared secret' yamakawa secret.txt --passphrase-env YAMAKAWA_PASSPHRASE
yamakawa secret.txt --passphrase 'shared secret'

--passphrase is convenient but risky because the value may be exposed through shell history or the process list. Prefer --passphrase-file, --passphrase-env, or interactive input.

Raw JSON

The default encrypted output is an armored ASCII message. Use --raw to output the versioned JSON envelope directly:

yamakawa --raw secret.txt -o secret.yamakawa.json

Security Notes

Do not send the encrypted message and the passphrase through the same channel. If you forget the passphrase, yamakawa cannot recover the plaintext.

Secret Gists and similar services should not be treated as secure secret stores. The encrypted bytes are protected, but message size, creation time, recipients, access logs, filenames, and service-side metadata are not hidden.

Version 1 intentionally does not implement public-key encryption, GPG or OpenSSL CLI compatibility, Gist API integration, key-management services, passphrase storage, compression, streaming encryption for very large files, multiple algorithms, a browser version, or a GUI.