Install the package from npm. SecureKit targets modern Node.js and uses the platform crypto implementation rather than pulling in a cryptography dependency tree.

npm i @bybence/securekit

Generate a canonical 256-bit Base64 key with the included CLI, then keep the key in your server-side environment rather than in client code or source control.

npx securekit generate-key

# .env.local
SECUREKIT_KEY=<generated-base64-key>

For a basic encrypted value, the public surface is intentionally short. The returned token is versioned so the package can identify its own format when reading it later.

import { encrypt, decrypt } from "@bybence/securekit";

const email = "hello@example.com";
const token = encrypt(email);
const value = decrypt(token);

console.log(value);
// "hello@example.com"

Purpose binding separates classes of encrypted data. A token created for one purpose should be decrypted with that same purpose, which helps prevent values from being moved between unrelated application fields by mistake.

const token = encrypt(email, {
  purpose: "user.email",
});

const emailAgain = decrypt(token, {
  purpose: "user.email",
});

Normal randomized encryption is intentionally unsuitable for direct equality queries. A blind index gives you a separate deterministic lookup value without making the ciphertext itself deterministic.

import { blindIndex } from "@bybence/securekit";

const emailIndex = blindIndex(email, {
  normalize: "email",
});

// Store emailIndex next to the encrypted value
// and query the index for exact matches.

Tokens carry enough version and key metadata for the application to detect values that should be moved to the current key. Rotation can happen gradually when data is read instead of requiring one all-at-once migration.

import { needsReencrypt, rotate } from "@bybence/securekit";

if (needsReencrypt(token)) {
  const rotatedToken = rotate(token);
  // persist rotatedToken
}

Sealed values are useful when application data should carry an authenticated expiration time. Expiration becomes part of the protected value instead of a separate convention the caller can accidentally skip.

import { seal } from "@bybence/securekit";

const token = seal(
  { action: "verify-email", userId: 123 },
  { expiresIn: "15m" }
);

Passwords are not encrypted. SecureKit exposes password hashing separately so application code does not accidentally treat passwords like reversible secrets. The package uses scrypt for this path.

import { hashPassword } from "@bybence/securekit";

const passwordHash = await hashPassword(password);

Do not use encrypt() as a replacement for password hashing. Password storage has a different threat model and should stay one-way.

The CLI handles setup and inspection tasks that are useful during development and deployment. The same package provides the runtime API and the diagnostics, so the checks stay aligned with the installed version.

npx securekit init
npx securekit generate-key
npx securekit doctor
npx securekit inspect <token>
npx securekit guide