# keycrypt
AES-256-GCM encryption helpers backed by the OS keychain.
`keycrypt` stores a 32-byte master key in the system keychain (via `keyring`) and uses it to
encrypt/decrypt data with `AES-256-GCM`. The key is auto-initialized on first encryption,
and decryption never auto-initializes (it fails if the key is missing).
## Features
- **AES-256-GCM** with a fresh random 12-byte nonce per encryption
- **OS keychain** storage for the master key (no `.env` key required)
- **Safe-ish key handling**: in-memory keys are held in `Zeroizing<[u8; 32]>`
- **Authenticated encryption**: ciphertext includes the GCM authentication tag
- **Stable format**:
- Current: `v1:nonce_b64:ciphertext_b64`
- Legacy accepted: `nonce_b64:ciphertext_b64`
## API
- `encrypt()` / `encrypt_bytes()`
- Ensures the key exists (auto-init on first use)
- `decrypt()` / `decrypt_bytes()`
- Fails if the key does not exist (no auto-init)
- `init_keychain_key()`
- Creates a random key in the keychain if missing
- `has_keychain_key()`
- Checks whether the key exists
## Example
```rust
use keycrypt::{encrypt, decrypt};
let enc = encrypt("hello")?;
let dec = decrypt(enc)?;
assert_eq!(dec, "hello");
# Ok::<(), keycrypt::CryptoError>(())