Crate cryptainer 

cryptainer

Small, password-based authenticated encryption for Rust.

cryptainer derives a 256-bit key from a password with Argon2id and encrypts data with AES-256-GCM. It supports no_std with alloc, while file I/O and typed struct encryption remain opt-in features.

Feature flags

• std (default) enables file helpers and standard-library integration.
• derive enables bincode-backed Serde struct encryption and the [Cryptainer] derive macro.
• zeroize (default) enables zeroization of derived keys and temporary serialized plaintext buffers where supported.

Examples

Encrypt bytes

let mut rng = rand::rng();
let data = encrypt_data("password", b"hello world", &mut rng)?;

Encrypt a struct

With the derive feature enabled, derive [Cryptainer] alongside Serde’s Serialize and Deserialize:

use cryptainer::Cryptainer;
use serde::{Deserialize, Serialize};

#[derive(Serialize, Deserialize, Cryptainer)]
struct Secret {
    message: String,
}

let mut rng = rand::rng();
let secret = Secret { message: "hello".into() };
let encrypted = secret.encrypt("password", &mut rng)?;
let decrypted = Secret::decrypt(&encrypted, "password")?;

Security notes

Every encryption generates a fresh salt and nonce. The serialized format is salt (16 bytes) || nonce (12 bytes) || ciphertext, where the ciphertext includes the AES-GCM authentication tag. Password strength and password transport are the responsibility of the calling application.

When zeroize is enabled, derived keys and temporary serialized plaintext buffers are cleared when dropped. Returned plaintext and caller-owned buffers remain the caller’s responsibility.

Decrypt bytes

let mut rng = rand::rng();
let encrypted = encrypt_data("password", b"hello world", &mut rng)?;
let plaintext = decrypt_data(&encrypted, "password")?;

Save and load files

let mut rng = rand::rng();
let data = encrypt_data("password", b"secret", &mut rng)?;
save_file("secret.stuff", &data)?;

let plaintext = decrypt_file("secret.stuff", "password")?;

With the derive feature, load and decrypt a persisted struct directly:

use cryptainer::{load_value, save_file};

save_file("secret.stuff", &encrypted)?;
let secret: Secret = load_value("secret.stuff", "password")?;

Structs

CryptData

Encrypted data returned by encrypt_data or encrypt_with_key.

Enums

CryptError

Errors returned by encryption, decryption, and file helpers.

Functions

decrypt_bytes

Decrypts serialized data encoded as salt || nonce || ciphertext.

decrypt_bytes_with_key

Parses and decrypts serialized encrypted data with a pre-derived key.

decrypt_data

Decrypts data produced by encrypt_data.

decrypt_file

Reads an encrypted file from disk and decrypts it with password.

decrypt_file_with_key

Reads an encrypted file and decrypts it with a pre-derived 256-bit key.

decrypt_with_key

Decrypts CryptData with a pre-derived 256-bit key.

derive_key

Derives a 256-bit Argon2id key from password and a 16-byte salt.

encrypt_data

Encrypts plaintext with a key derived from password.

encrypt_with_key

Encrypts plaintext with a pre-derived 256-bit key and caller-provided 16-byte salt.

load_file

Loads serialized encrypted data from disk.

save_file

Writes encrypted data to disk in salt || nonce || ciphertext order.

Type Aliases

KeyBuffer

A 32-byte derived key that is zeroized when dropped.