e5t is a small Go package for AES-256-GCM encryption and decryption. It is designed for applications that need a compact, easy-to-review encryption helper with no external dependencies: only the Go standard library is used.

The package encrypts byte slices, generates a fresh random nonce for every encryption operation, prefixes that nonce to the ciphertext, and can return either raw encrypted bytes or a hex-encoded string for storage and transport.

• AES-256-GCM authenticated encryption using crypto/aes and crypto/cipher
• Fresh random nonce generation with crypto/rand
• Raw byte and hex-encoded ciphertext APIs
• Deterministic 32-byte key helper based on SHA-256
• Sentinel errors for invalid key size and short ciphertext handling
• Zero third-party dependencies
• Apache-2.0 licensed

go get github.com/slashdevops/e5t

Update to the latest available version:

go get -u github.com/slashdevops/e5t

• Go 1.26.3 or newer
• No external Go modules

package main

import (
    "fmt"
    "log"

    "github.com/slashdevops/e5t"
)

func main() {
    key := e5t.GenerateHashKey("my-secret-password", "unique-salt")

    plaintext := []byte("sensitive data")
    encrypted, err := e5t.EncryptAsString(plaintext, key)
    if err != nil {
        log.Fatal(err)
    }

    decrypted, err := e5t.DecryptFromText(encrypted, key)
    if err != nil {
        log.Fatal(err)
    }

    fmt.Println(string(decrypted))
}

func GenerateHashKey(secret string, salt ...string) []byte

GenerateHashKey returns a 32-byte key by hashing secret + salt with SHA-256. The optional salt is useful when deriving separate keys for different environments, tenants, users, or data classes.

key := e5t.GenerateHashKey("application-secret", "production-config-v1")

This helper is intentionally simple and dependency-free. For user-entered passwords or high-risk secrets, prefer passing Encrypt and Decrypt a 32-byte key produced by your platform's key management system or by a dedicated password-based key derivation strategy.

func Encrypt(plaintext []byte, key []byte) ([]byte, error)

Encrypt encrypts plaintext with AES-256-GCM and returns raw bytes. The returned value is formatted as:

nonce || ciphertext || authentication-tag

Use this API when you want to store or transmit binary data directly.

encrypted, err := e5t.Encrypt([]byte("secret message"), key)
if err != nil {
    return err
}

func EncryptAsString(plaintext []byte, key []byte) (string, error)

EncryptAsString encrypts plaintext and returns the encrypted bytes as a hex string. Use it for text-only storage locations such as environment variables, JSON fields, fixtures, or database columns that expect text.

encrypted, err := e5t.EncryptAsString([]byte("secret message"), key)
if err != nil {
    return err
}

func Decrypt(ciphertext []byte, key []byte) ([]byte, error)

Decrypt reverses Encrypt. It expects raw encrypted bytes containing the nonce prefix generated by Encrypt.

decrypted, err := e5t.Decrypt(encrypted, key)
if err != nil {
    return err
}

func DecryptFromText(hexCiphertext string, key []byte) ([]byte, error)

DecryptFromText reverses EncryptAsString. It decodes the hex string and then decrypts the underlying bytes.

decrypted, err := e5t.DecryptFromText(encryptedText, key)
if err != nil {
    return err
}

func VerifyEncryption(original []byte, encrypted string, key []byte) (bool, error)

VerifyEncryption decrypts a hex-encoded ciphertext and compares the result with original.

encrypted, err := e5t.EncryptAsString(original, key)
if err != nil {
    return err
}

match, err := e5t.VerifyEncryption(original, encrypted, key)
if err != nil {
    return err
}
if !match {
    return errors.New("decrypted data does not match original")
}

AES-GCM already authenticates ciphertext during decryption. Use VerifyEncryption when your application specifically needs to compare decrypted data with an expected plaintext value.

The package exposes sentinel errors for common validation failures:

var (
    ErrInvalidKeySize     = errors.New("key must be exactly 32 bytes for AES-256")
    ErrCiphertextTooShort = errors.New("ciphertext shorter than nonce prefix")
)

Use errors.Is when branching on these errors:

decrypted, err := e5t.DecryptFromText(encrypted, key)
if err != nil {
    switch {
    case errors.Is(err, e5t.ErrInvalidKeySize):
        return fmt.Errorf("invalid encryption key: %w", err)
    case errors.Is(err, e5t.ErrCiphertextTooShort):
        return fmt.Errorf("invalid ciphertext: %w", err)
    default:
        return fmt.Errorf("decrypt data: %w", err)
    }
}
_ = decrypted

Other errors may come from the Go standard library, such as hex decoding errors or AES-GCM authentication failures when ciphertext is corrupted or the wrong key is used.

• Keep encryption keys out of source control and application logs.
• Use a unique salt or context string when deriving separate keys with GenerateHashKey.
• Store or transmit the full encrypted output. The nonce prefix is required for decryption and is safe to store with the ciphertext.
• Reusing a key is expected; reusing a key and nonce pair is not. Encrypt and EncryptAsString generate a fresh nonce automatically.
• Losing the key means losing the ability to decrypt the data.
• A wrong key, modified ciphertext, or truncated ciphertext causes decryption to fail.
• GenerateHashKey is a convenience helper, not a memory-hard password hashing function.

The repository follows the same GitHub quality practices used by slashdevops/httpx:

• main.yml validates pushes to main with format checks, go vet, race-enabled tests, coverage, and go build.
• pr.yml runs the same quality gate for pull requests targeting main.
• codeql.yml runs CodeQL for Go and GitHub Actions on pushes, pull requests, and a weekly schedule.
• release.yml validates tagged releases and publishes GitHub releases with generated notes.
• dependabot.yml checks Go module and GitHub Actions updates weekly.

.
|-- .github/         GitHub Actions, CodeQL, Dependabot, and release metadata
|-- .golangci.yaml   Optional local golangci-lint configuration
|-- doc.go           Package documentation rendered by pkg.go.dev
|-- e5t.go           Public encryption API
|-- e5t_test.go      Unit tests and benchmarks
|-- example_test.go  Executable Go examples for documentation
|-- go.mod           Module definition with no external requirements
|-- LICENSE          Apache License 2.0
|-- README.md        Project overview and usage guide
`-- SECURITY.md      Vulnerability reporting policy

Run the test suite:

go test ./...

Run benchmarks:

go test -bench=. ./...

Check test coverage:

go test -cover ./...

Run the same local quality checks used by CI:

go fmt ./...
go vet ./...
go test -race -coverprofile=/tmp/e5t-coverage.txt -covermode=atomic ./...
go build ./...

e5t is licensed under the Apache License 2.0.

Issues and pull requests are welcome at github.com/slashdevops/e5t. Please keep changes small, idiomatic, tested, documented, and dependency-free unless there is a clear reason to expand the project scope.