# cryptainer
Tiny encrypted byte array container for Rust.
`cryptainer` encrypts arbitrary bytes with **AES-256-GCM** using a key derived from a password with **Argon2id**. It can also save and load encrypted data from files when the `std` feature is enabled.
## Features
- Password-based encryption with Argon2id
- AES-256-GCM authenticated encryption
- `no_std` support by default with `alloc`
- Optional zeroization support
- File helpers behind `std`
## Usage
### Encrypt bytes
```rust
use cryptainer::encrypt_data;
let mut rng = rand::rng();
let data = encrypt_data("password", b"hello world", &mut rng)?;
```
### Decrypt bytes
```rust
use cryptainer::{decrypt_data, encrypt_data};
let mut rng = rand::rng();
let encrypted = encrypt_data("password", b"hello world", &mut rng)?;
let plaintext = decrypt_data(&encrypted, "password")?;
```
### Save and load files
```rust
use cryptainer::{decrypt_file, encrypt_data, save_file};
let mut rng = rand::rng();
let data = encrypt_data("password", b"secret", &mut rng)?;
save_file("secret.stuff", &data)?;
let plaintext = decrypt_file("secret.stuff", "password")?;
```
## Data format
Encrypted output is stored as:
`salt (16 bytes) || nonce (12 bytes) || ciphertext`
## API
- `encrypt_data(password, plaintext, rng) -> Result<CryptData, CryptError>`
- `decrypt_data(data, password) -> Result<Vec<u8>, CryptError>`
- `save_file(file_path, data) -> Result<(), CryptError>` *(std only)*
- `decrypt_file(file_path, password) -> Result<Vec<u8>, CryptError>` *(std only)*
## Features
- `std` (default): enables file I/O and standard library integration
- `zeroize`: zeroizes derived key material when available
## License
MIT