Crate memguard_rs 

memguard-rs

Secure memory handling primitives for Rust.

Features

• Zeroization on drop — volatile-write memory clearing the compiler cannot optimize away
• Memory locking — mlock/VirtualLock to prevent secrets from being written to swap
• Constant-time comparison — timing side-channel resistant equality checks for secrets
• Compile-time guarded regions — const-generic memory regions with type-level size enforcement
• no_std compatible — core primitives work without an allocator
• Zero dependencies — no transitive dependency surface to audit

Quick start

use memguard_rs::Secret;

let mut key = Secret::new([0u8; 32]);

// Access the secret only within a closure — it's not exposed outside
key.expose(|k| {
    assert_eq!(k.len(), 32);
});

// Modify in place
key.expose_mut(|k| {
    k[0] = 0xFF;
});

// When `key` goes out of scope, its memory is zeroized via volatile writes

Re-exports

pub use cmp::ct_eq;

pub use cmp::ct_select;

pub use error::Error;

pub use error::Result;

pub use guard::GuardedRegion;

pub use secret::Secret;

pub use zeroize::Zeroize;

Modules

cmp

Constant-time comparison functions for secret data.

error

Error types for the memguard-rs crate.

guard

Compile-time enforced memory safety boundaries using const generics.

mlock

Memory locking primitives to prevent swapping of sensitive data.

secret

Secret wrapper type that zeroizes on drop and optionally locks memory.

zeroize

Secure zeroization of memory.