rvault: secure and authenticated store for secrets and small documents
Self-hosted video transcoding and encrypted HLS delivery: FFmpeg ABR ladders on EC2 Spot, per-video AES-128 keys wrapped by KMS, tokenized playback, and an API-first control plane. Terraform for AWS; runs locally with no AWS account.
Very simple envelope encryption library
Offline auditor for an envelope encryption key hierarchy - wrap graph integrity, strength ordering, rotation status and per-key blast radius.
Transparent property-level encryption for EF Core with envelope encryption and key rotation.
A Go-based proxy that provides transparent encryption/decryption for S3 objects with envelope encryption.
Obsidian plugin for transparent encryption of secret blocks and binary files using AWS KMS. Zero plaintext on disk.
The Eonian Secrets Locker provides in-app decryption of encrypted secrets at runtime. Encrypted secrets can be on the class path, the file system, or in AWS S3. Secrets are decrypted into Java Strings or Properties. Their plaintext is not written to disk. The library provides interfaces which can be implemented by different encryption providers.
Stream-encrypted file vault featuring AES-256-GCM envelope encryption, license-based access control, direct S3 streaming, encryption key versioning/rotation with boot-time checks, and full test coverage.
코드 변경 없이 마스킹·암호화·위변조 방지를 지원하는 로깅 SDK
Ruby bindings for the envelopers envelope-encryption library
Secrets vault & self-hosted KMS for AI agents — client holds only ciphertext, master key lives in a separate mTLS daemon.
Self-hosted secrets manager and IAM for Docker, classic SSH deployments, Docker Swarm, k3s and Kubernetes. Envelope encryption on OpenBao, hardware-key unseal, tamper-evident audit log, push publishing that keeps running while the vault is sealed.
Lokki - Aplikasi password manager desktop (Java Swing). Projek akhir PBO yang iseng dikembangin jadi beneran. 100% lokal, enkripsi AES-256-GCM.
Batteries-included Go cryptography library: AES-256-GCM & ChaCha20-Poly1305 authenticated encryption, argon2id/bcrypt password hashing, HMAC & Ed25519 signing, HKDF, key rotation, KMS envelope encryption, and secure random — safe defaults, one dependency (golang.org/x/crypto), byte-for-byte interop with the TypeScript crypt-ts.
Secure arbitrary objects in localStorage using AES-GCM envelope encryption with device-bound KEK (IndexedDB) or Argon2id-derived KEK (master password).
🔐 Envelope encryption with independent keyslots for Go — unlock with a password, a YubiKey, 2FA, or a recovery code, and add/remove methods without re-encrypting the payload
Offline auditor for an envelope encryption key hierarchy: manifest parsing, key graph, blast radius, and rotation planning.
Ultra-secure, 100% offline password manager for Android with biometric security and zero-knowledge encryption.
Transparent client-side encryption proxy for S3 — AES-256-GCM envelope encryption, zero code changes, Kubernetes-native with Helm chart
To associate your repository with the envelope-encryption topic, visit your repo's landing page and select "manage topics."