Symmetric

The request body must be JSON:

• action"encrypt" | "decrypt"required

  Action to perform: encrypt or decrypt

• textstringrequired

  Text to encrypt, or base64 blob to decrypt

• keystringrequired

  Encryption key (minimum 8 characters)

• algorithm"aes-256-gcm" | "aes-256-cbc" | "aes-128-gcm"optional

  Cipher algorithm: aes-256-gcm (default), aes-256-cbc, or aes-128-gcm

The raw key is never used directly. It is derived using scryptSync with a random 16-byte salt, producing a secure fixed-length key regardless of input length.

Encrypted output is returned as a base64 string with a binary layout that depends on the algorithm:

GCM: [16 bytes salt][12 bytes IV][16 bytes auth tag][ciphertext]
CBC: [16 bytes salt][16 bytes IV][32 bytes HMAC-SHA256 MAC][ciphertext]

• Salt (16 bytes): used to derive the key (and, for CBC, a separate HMAC key)
• IV: initialization vector (12 bytes for GCM, 16 bytes for CBC)
• Auth tag / MAC: integrity verification — a native GCM tag (16 bytes) for GCM, or an HMAC-SHA256 MAC (32 bytes) for CBC, checked with a constant-time comparison
• Ciphertext: the encrypted content

Pass this blob as text to decrypt.

• actionstring

  Action performed (encrypt or decrypt)

• algorithmstring

  Cipher algorithm used

• resultstring

  Encrypted base64 blob, or decrypted plaintext

If parameters are missing or invalid, the API will return an error:

• 400Action is requiredThe action parameter is missing
• 400Action must be one of: encrypt, decryptThe action value is not valid
• 400Text is requiredThe text parameter is missing or empty
• 400Text exceeds maximum allowed lengthThe text exceeds the maximum length
• 400Key is requiredThe key parameter is missing
• 400Key must be at least 8 charactersThe key is shorter than 8 characters
• 400Algorithm must be one of: aes-256-gcm, aes-256-cbc, aes-128-gcmThe algorithm value is not supported