Encrypting a field before it lands in your database or object storage, using authenticated AES-256-GCM.
Overview
Authenticated AES-256-GCM encrypt/decrypt (with AAD), PBKDF2 & HKDF key derivation, SHA-2, HMAC, secure random and constant-time compare — a thin, correct layer over Web Crypto. Plus a versioned Keyring for envelope encryption & key rotation. Encrypt Mongo fields, S3 payloads and cookies.
Install
$ npm install @lacspace/crypto
Quick example
@lacspace/cryptots
await decrypt(await encrypt(data, key), key)
Returns data
Tips
Built on Web Crypto — the same code works in Node, browsers and the edge.
Store the key outside your code (env/secret manager); rotate by versioning ciphertext.
Zero-dependency and isomorphic — safe to import on the server, in the browser, on the edge and in React Native. It tree-shakes, so you only ship what you import.
Watch out for
Never hand-roll crypto or reuse a nonce — the package manages nonces per message; don't override that.
Losing the key means losing the data — back it up securely.
Looking for the complete API and more examples? The npm page and GitHub README carry the full reference — or grab the PDF.
