Encryption Helpers

Encryption helpers provide functions to encrypt and decrypt sensitive data using AES-GCM with PBKDF2 key derivation.

Basic Usage

import { function decrypt(encrypted: string | undefined | null, secret: string): Promise<string | undefined>
Decrypts a base64url encoded string using AES-GCM with a secret key.
Returns the original string if decryption is successful, or undefined if it fails.
@example```ts
const encrypted = await encrypt("Hello, World!", "test-secret-key")
const decrypted = await decrypt(encrypted, "test-secret-key")
expect(decrypted).toBe("Hello, World!")
```@see{@link https://orpc.dev/docs/helpers/encryption Encryption Helpers}decrypt, function encrypt(value: string, secret: string): Promise<string>
Encrypts a string using AES-GCM with a secret key.
The output is base64url encoded to be URL-safe.
@example```ts
const encrypted = await encrypt("Hello, World!", "test-secret-key")
const decrypted = await decrypt(encrypted, "test-secret-key")
expect(decrypted).toBe("Hello, World!")
```@see{@link https://orpc.dev/docs/helpers/encryption Encryption Helpers}encrypt } from '@orpc/server/helpers'

const const secret: "your-encryption-key"secret = 'your-encryption-key'
const const sensitiveData: "user-email@example.com"sensitiveData = 'user-email@example.com'

const const encryptedData: stringencryptedData = await function encrypt(value: string, secret: string): Promise<string>
Encrypts a string using AES-GCM with a secret key.
The output is base64url encoded to be URL-safe.
@example```ts
const encrypted = await encrypt("Hello, World!", "test-secret-key")
const decrypted = await decrypt(encrypted, "test-secret-key")
expect(decrypted).toBe("Hello, World!")
```@see{@link https://orpc.dev/docs/helpers/encryption Encryption Helpers}encrypt(const sensitiveData: "user-email@example.com"sensitiveData, const secret: "your-encryption-key"secret)
// 'Rq7wF8...' (base64url encoded, unreadable)

const const decryptedData: string | undefineddecryptedData = await function decrypt(encrypted: string | undefined | null, secret: string): Promise<string | undefined>
Decrypts a base64url encoded string using AES-GCM with a secret key.
Returns the original string if decryption is successful, or undefined if it fails.
@example```ts
const encrypted = await encrypt("Hello, World!", "test-secret-key")
const decrypted = await decrypt(encrypted, "test-secret-key")
expect(decrypted).toBe("Hello, World!")
```@see{@link https://orpc.dev/docs/helpers/encryption Encryption Helpers}decrypt(const encryptedData: stringencryptedData, const secret: "your-encryption-key"secret)
// 'user-email@example.com'