{"id":30920755,"url":"https://github.com/sebadob/cryptr","last_synced_at":"2025-09-10T01:50:40.282Z","repository":{"id":212840441,"uuid":"732435237","full_name":"sebadob/cryptr","owner":"sebadob","description":"simple encrypted (streaming) values","archived":false,"fork":false,"pushed_at":"2025-08-11T08:37:17.000Z","size":101080,"stargazers_count":3,"open_issues_count":0,"forks_count":3,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-08-11T10:28:00.157Z","etag":null,"topics":["cli","decryption","encryption","s3","s3-storage","streaming"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sebadob.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2023-12-16T17:01:42.000Z","updated_at":"2025-08-11T08:36:53.000Z","dependencies_parsed_at":"2023-12-20T16:04:48.681Z","dependency_job_id":"88e55406-6030-4d4f-93af-b217ee939d7e","html_url":"https://github.com/sebadob/cryptr","commit_stats":null,"previous_names":["sebadob/cryptr"],"tags_count":14,"template":false,"template_full_name":null,"purl":"pkg:github/sebadob/cryptr","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sebadob%2Fcryptr","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sebadob%2Fcryptr/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sebadob%2Fcryptr/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sebadob%2Fcryptr/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sebadob","download_url":"https://codeload.github.com/sebadob/cryptr/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sebadob%2Fcryptr/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":274397769,"owners_count":25277400,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-09T02:00:10.223Z","response_time":80,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cli","decryption","encryption","s3","s3-storage","streaming"],"created_at":"2025-09-10T01:50:34.255Z","updated_at":"2025-09-10T01:50:40.265Z","avatar_url":"https://github.com/sebadob.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# cryptr - simple encrypted (streaming) values\n\nThe idea of cryptr is to provide a simple and robust way of encryption all different kinds of values.\n\n## Why\n\nThe main idea why `cryptr` was created is that I needed to encrypt small values in different projects, because I just\ndid not want to save them in clear text inside the database or somewhere else. With passwords, you have hashing, but\nthat is not an option when you need to be able to read that value inside the application at some point, like for\ninstance Webauthn user data.\n\nI had two very simple, small functions for exactly that use case which I copy \u0026 pasted all over the place. This became\nreally tedious at some point and even more, when I did an improvement on them.\nAnother problem was, that these did not care about future-proof ways of doing it at all. When I did a change on the\nfunctions, I needed to handle the migration of all encrypted values manually each time, which was really annoying.\n\n`cryptr` can also handle (streaming) file encryption in a very efficient and fast way. Encrypting / decrypting small\nvalues will happen in memory and it very straight forward. For bigger files, you can create an encryption stream and\nprovide a generic reader and a writer.\n\n## What it can do\n\n### Direct encryption of small values\n\nI created `cryptr` to handle all of that stuff in a really fast, efficient and robust way.\n\nIt can handle small values that you want to encrypt for a special database column for instance without much overhead or\nsetup needed. You don't need to track the encryption key that was used with the value, because you should always be able\nto do key rotations and stuff.\n\nA **tiny header with usually below 40 bytes** (depending on if you choose a custom, long key id) will be added to the\nvalue, which then contains all the necessary information. In all my projects, I had this information in different\ncolumns and needed to handle all of this manually each time. This is not the case no more.\n\n### Streaming\n\nWhat `cryptr` can do as well is streaming encryption on-the-fly with very minimal memory usage.\n\nI use it for instance to do a streaming replication of database backups to an external storage. It can basically handle\n**files of any size**, read them piece by piece, do an on-the-fly streaming encryption using **ChaCha20Poly1305** and\nthen stream the chunks to the external **S3 object storage** directly.\n\nPerformance does not suffer from this at all. The load and tasks are spread over multiple cores internally and 4 small\nbuffers are used in between the tasks. The memory overhead is very minimal, and you can stream files of any size with\njust a few MB of memory during the whole operation.\n\nSince the encryption happens locally, you can use it easily in environments, where you may not trust the storage admin\nor whoever has access to it.\n\n### Tamper Resistant\n\n`cryptr` uses AEAD streaming encryption algorithms (only ChaCha20Poly1305 at the moment). This means, that the whole\nencrypted payload and each streamed chunk have appended MACs. Even if someone would tamper with your data, the worst\nthing that can happen, is that the encryption does not work or actually complain, that the payload is corrupted. The\ndata is not only encrypted, but validated at the same time, that it is still the original value.\n\n### CLI and library\n\n`cryptr` comes as a CLI tool, or it can be used in any project as a normal crate.\n\nThe CLI can handle most cases already and even provides a nice UX with importing and setting values via CLI instead of\nmanually updating the config file. You can do in-memory as well as streaming operations via CLI, even to S3 storage\nalready.\n\n#### Install CLI\n\nYou can install the CLI via `cargo` for now:\n\n```notest\ncargo install cryptr --features cli\n```\n\n## Examples\n\nYou can find usage examples for both the library and the CLI in\nthe [examples](https://github.com/sebadob/cryptr/tree/main/examples) folder.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsebadob%2Fcryptr","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsebadob%2Fcryptr","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsebadob%2Fcryptr/lists"}