cryptainer

Tiny encrypted byte array container for Rust.

cryptainer encrypts arbitrary bytes with AES-256-GCM using a key derived from a password with Argon2id. It can also save and load encrypted data from files when the std feature is enabled.

Features

• Password-based encryption with Argon2id
• AES-256-GCM authenticated encryption
• no_std support by default with alloc
• Optional zeroization support
• File helpers behind std

Usage

Encrypt bytes

use cryptainer::encrypt_data;

let mut rng = rand::rng();
let data = encrypt_data("password", b"hello world", &mut rng)?;

Decrypt bytes

use cryptainer::{decrypt_data, encrypt_data};

let mut rng = rand::rng();
let encrypted = encrypt_data("password", b"hello world", &mut rng)?;
let plaintext = decrypt_data(&encrypted, "password")?;

Save and load files

use cryptainer::{decrypt_file, encrypt_data, save_file};

let mut rng = rand::rng();
let data = encrypt_data("password", b"secret", &mut rng)?;
save_file("secret.stuff", &data)?;

let plaintext = decrypt_file("secret.stuff", "password")?;

Data format

Encrypted output is stored as:

salt (16 bytes) || nonce (12 bytes) || ciphertext

API

• encrypt_data(password, plaintext, rng) -> Result<CryptData, CryptError>
• decrypt_data(data, password) -> Result<Vec<u8>, CryptError>
• decrypt_bytes(data, password) -> Result<Vec<u8>, CryptError>
• save_file(file_path, data) -> Result<(), CryptError> (std only)
• decrypt_file(file_path, password) -> Result<Vec<u8>, CryptError> (std only)

Features

• std (default): enables file I/O and standard library integration
• zeroize: zeroizes derived key material when available

License

MIT