STRCrypt

Key features

When applications, batch jobs, and databases use different encryption modules, ciphertext created on one side cannot be decrypted on the other. STRCrypt's CLI, language bindings, and SQL functions share one ciphertext format, so each can decrypt the others' ciphertext with the same key and mode.

• Strings and columns — language bindings and SQL functions for Oracle, PostgreSQL, MySQL, and MariaDB
• File encryption and decryption — large files processed in chunks
• Batch encryption and decryption — multiple records in one call
• Algorithm selection — eight algorithms including ARIA, SEED, and LEA; mode-specific availability
• Ciphertext compatibility — shared format and automatic algorithm detection during decryption
• Exact-match search — deterministic indexes for encrypted columns

Downloads

Release 0.3.1 (2026-09-27). Executables and language bindings are provided for Linux x86_64 and Windows x64. Database integrations are Linux only. Windows language bindings and new C shared library functions have not been execution-tested. Release changes are listed in the changelog.

If you installed the Oracle or PostgreSQL integration from 0.3.0 or earlier, see the 0.3.1 security notice for revoking the grants.

5acdc1050e529feafbb58a333ebb3eaab34e107673fe1f7440c26f0dfb6b8b10  strcrypt
e40771bfe04d5cb8eeac4165c4a1d41c11b824fb19602e74696630f18835bc4d  strcrypt.hmac
8658616358f3483a0da3d19f3f855515591de99b52d289cd8bf497032c5966ed  strcrypt.exe
823927850306afca2a91c16f7689f0d81786bab74b75500ff69bd905d0541a31  strcrypt.exe.hmac
25aa998ef34bbdfb2c4be17dd7bc0fb1c20bf96c52a69a9bc03e9c04e3a89339  strcrypt-0.3.1-cp314-cp314-manylinux_2_28_x86_64.whl
e4fe5d52449393041a841ecce4d832f1b64f57ae10cfdaa14c3a4c1e6c02217a  strcrypt-0.3.1-cp314-cp314-win_amd64.whl
8ca77f9060d1ae22b88809132ab2d5eed8525f838cd7f939268657acfef3cc40  strcrypt-0.3.1-cp313-cp313-manylinux_2_28_x86_64.whl
62a2337ae2a45b2fe643de51e9b6a961c661d642934ee8610a9ba710089ed740  strcrypt-0.3.1-cp313-cp313-win_amd64.whl
cfaf28fa094e9d9262437694a5eae7e02d7e171841b00cd8ca7cd35595d8b8a7  strcrypt-0.3.1-cp312-cp312-manylinux_2_28_x86_64.whl
4532dd69de8d319eec39c6ea541544bfd9bb7a00da43b168fc71029493c4f8a5  strcrypt-0.3.1-cp312-cp312-win_amd64.whl
1b637c39c63ad96b951993809b5fa2035818fff6d97c2ddfa439145577fc778d  strcrypt-0.3.1-cp311-cp311-manylinux_2_28_x86_64.whl
a5d4e694e13d3c72f74d57e7dc71104173a2a529bacb5334a0f118cd74a64f3b  strcrypt-0.3.1-cp311-cp311-win_amd64.whl
0912528b38b79529a35df3798ae63f48c8c81c16887f79a52b1f58b52fbddb37  strcrypt-0.3.1-cp310-cp310-manylinux_2_28_x86_64.whl
a0199467b323f35d80a7e437b4726d87f6dbfe2930482683291660b191904800  strcrypt-0.3.1-cp310-cp310-win_amd64.whl
85478c6b2a5fe22312de6d7efe9acee60dcfd6cc0ca98b233365b81cf516900a  strcrypt-0.3.1-cp39-cp39-manylinux_2_28_x86_64.whl
453a2b3203ce385f7ea4c7d7cced1289547f9549408b4456390583eae539a4a1  strcrypt-0.3.1-cp39-cp39-win_amd64.whl
77c4fa0da53a38240340555218d1806b581b4a39e879467e0cb07d856464d7bb  strcrypt-0.3.1.tgz
866b9e7e5af1abe723b44df0740a871227e5d61230cdc6483b38f1f568770333  strcrypt-0.3.1.jar
1a6f47a95cdd9e6c8ba3ee5fb55ad0f82f3081ed2e8e3716a990db622d74be6b  libstrcrypt_jni.so
8357b7b9a391bda4755bea19fed92622fab4c943048d8357e0bfc195150b6a5d  strcrypt_jni.dll
fcc558cd7eeaa972651b3a4f976e78199a66d4bbade0d696d7badd693505bcff  strcrypt-oracle-0.3.1.tar.gz
ee7c538f306f3f816fa32d5b2ae04be32dd3aa3edb824fa16c4b659083e656e0  strcrypt-postgresql-0.3.1.tar.gz
14a73d4b20240910b4d1b5cb49b053023c0ee401080a63067a949795b9eed541  strcrypt-mysql-0.3.1.tar.gz
9fe980205265939e321abce976faedd77441dec9b1fc5863ae52ad3fa09142cd  libstrcrypt.so
5309b16947e4930a5e49ffca09e964d37355e4d20187029c21927eaafdf0ea18  libstrcrypt.so.hmac
4db8a506dce1afd63f4a9fbcab1fd1ab53068bf1c58eb5acfc4ee7231f8f06a7  strcrypt.dll
80bddda42cb2b0e28ab6373b7346df30d80885d59871ee1ae3b9622353b200a8  strcrypt.dll.hmac
40a0ec7918ee503e517d9fa7620e3c95e8a68a123fcdbc46f61b6ea0d0a62bbd  strcrypt.dll.lib
f9fd47a59da97482976dbd641659add955a414369592df70b18d2a0adb8aed56  strcrypt.h
21efc5355b0816b93643600c13a7a7c0154672d43abc13c35e7b2c9e09b396fe  strcrypt-0.3.1-src.tar.gz
a72581d68b6be4eb591f5b5e1f68520eb34c86b393157fe2100b5b4c3eb9a064  strcrypt-0.3.1-src.tar.xz
517db1aafe05de8c90e9bb200a8264bbb00a0db4ad128e993dd2e52956ae0086  strcrypt-0.3.1-src.zip
80fba723f2edd01f683ef2192a21bf195269d86265917b70e49d79afabe51ba9  LICENSE
b0fc866c89d2e063cac6c0875e8af36448661cfd04d9adb490ffd5956f1247c0  LICENSE-THIRD-PARTY

Verify checksums (run in the download directory)

Linux (bash)

sha256sum -c --ignore-missing SHA256SUMS

Windows (PowerShell)

Get-Content SHA256SUMS | ForEach-Object {
  $hash, $name = $_ -split '\s+', 2
  if (Test-Path $name) {
    if ((Get-FileHash $name -Algorithm SHA256).Hash -eq $hash) { "$($name): OK" } else { "$($name): FAILED" }
  }
}

Executables and shared libraries check for corruption using the .hmac file on first initialization. The check is skipped if the file is missing.

Windows executables and DLLs are not Authenticode-signed. SmartScreen warnings may occur, and execution is restricted in environments that require signed code.

Quick start

1. Choose files for your operating system and interface from Downloads, then verify the SHA-256 checksums.
2. Create a key file and point the STRCRYPT_KEY_FILE environment variable to it.
3. Run the installation steps and encryption examples in the guides.

Generate a key file

Linux (bash)

(umask 077; openssl rand -base64 32 | head -c 32 > strcrypt.key)
export STRCRYPT_KEY_FILE="$PWD/strcrypt.key"

Windows (PowerShell)

$key = Join-Path $PWD 'strcrypt.key'
$bytes = [byte[]]::new(24)
[Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($bytes)
[IO.File]::WriteAllText($key, [Convert]::ToBase64String($bytes))
icacls $key /inheritance:r /grant:r "$($env:USERNAME):F"
$env:STRCRYPT_KEY_FILE = $key

Linux key files require permission 0600. Windows file permissions are not checked; the example uses icacls to restrict access to the current user. STRCRYPT_KEY can set the key directly, but a key file is recommended to avoid exposure in process information. The key is read once at the first encryption or decryption. Restart the process after key rotation. Decryption is impossible if the key is lost; keep a separate backup.

The example generates 32 base64 characters (192 bits of randomness); file contents are used directly as key bytes. SEED-128-GCM, LEA-128-GCM, AEGIS-128L, and ASCON-128 use the first 16 bytes (96 bits of randomness). The default algorithm is ARIA-256-GCM.

Guides

• CLI Command-line encryption and decryption of strings, files, and record lists
• Python Wheel installation and string, bytes, batch, and file functions
• Node.js npm package installation and use from CommonJS, ESM, or TypeScript
• Java JAR and native library installation; encryption and decryption functions
• Oracle SQL function installation and batch encryption and decryption of many rows
• PostgreSQL Extension installation and encryption and decryption with SQL functions and the CLI
• MySQL UDF registration and encryption and decryption with SQL functions and the CLI
• MariaDB UDF registration and encryption and decryption with SQL functions and the CLI

Algorithms and modes

The default korean-standard mode allows ARIA, SEED, and LEA, with ARIA-256-GCM as the default algorithm. non-approved allows all eight algorithms, with AEGIS-128L as its default. Decryption detects the algorithm from the ciphertext header.

Switch modes with --mode non-approved in the CLI, or with the environment variable STRCRYPT_MODE=non-approved in the libraries. korean-standard specifies algorithm availability and does not indicate KCMVP certification. The deprecated name kcmvp-approved maps to the same mode.

Exact-match search index

strcrypt_search_index generates a deterministic 64-character hex index from the master key and input value. SQL functions and Python, Node.js, and Java bindings return the same result. Store the index in a separate column and compare it with the search value's index for exact matches. Computing the index requires the master key. Identical values produce identical indexes, exposing equality and frequency.

System requirements

Operating system

Linux x86_64 with glibc 2.28 or later (for example RHEL or Rocky Linux 8, Debian 10, Ubuntu 20.04 or later) / Windows 10 and 11 x64

CLI

No additional installation (no Visual C++ Redistributable on Windows)

Python

3.9 to 3.14

Node.js

18 or later

Java

11 or later

Oracle

19c and 26ai on an Oracle Linux 8 or later database server (glibc 2.28 or later), with the AL32UTF8 character set. Published files do not load on Oracle Linux 7

PostgreSQL

18 on a Linux database server, with UTF8 database encoding

MySQL

8.4 on a Linux database server, with the utf8mb4 character set

MariaDB

11.8 on a Linux database server, with the utf8mb4 character set

Key

1–32 bytes; zero-padded to 32 bytes. Minimum 16 bytes in the default mode. The example below generates a 32-byte key file.

Source code

Sources include the core library, Python, Node.js, and Java bindings, database C wrappers, and installation SQL. rust-toolchain.toml and Cargo.lock pin the Linux build toolchain and dependencies. ZIP, tar.gz, and tar.xz contain the same source. Tests, internal documents, and Windows static C runtime build settings are excluded.

Limitations and license

• STRCrypt is not a cryptographic module with an official security certification such as KCMVP. It does not fit environments that require a validated module.
• The calling application manages key storage, backup, and rotation. Ciphertext cannot be recovered without its key.
• Ciphertext uses the STRCrypt format and is not directly compatible with other cryptographic libraries.
• It is provided free of charge under the MIT License, which allows commercial use and redistribution. No warranty is provided (LICENSE).
• The open source components included in the binaries and their licenses are listed in LICENSE-THIRD-PARTY. All are MIT, Apache-2.0, BSD, or ISC licensed; no GPL-family components are included. The Windows binaries statically link the Microsoft C runtime.
• Security fixes are provided for the latest release only. Upgrade to the latest version to resolve vulnerabilities in earlier versions.
• Report vulnerabilities through the contact form using "Security Vulnerability". Include the affected version, environment, and reproduction steps; keep reproduction details private.
• Submit errors and feature requests through the contact form.