Home Docs Pricing Download →

> Encryption that just works.

Drop-in encrypted filesystem for Node.js. Zero dependencies. AES-256-GCM. One line to integrate.

$ npm install dark-envelope
Copied!

Coming Q2 2026

// Live Demo

See it in action

terminal
0
Dependencies
256-bit
AES-GCM Keys
14
Production Bots
4.9 KB
Package Size
// Drop-in replacement

One require(). Fully encrypted.

BEFORE 
var fs = require('fs');
fs.writeFileSync(path, userData);
var data = fs.readFileSync(path);
// ❌ Plaintext on disk. Exposed.
AFTER 
var defs = require('dark-envelope')(userId);
defs.writeFileSync(path, userData);
var data = defs.readFileSync(path);
// ✔ AES-256-GCM encrypted. Per-user keys.

Same API. Now encrypted.

// Capabilities

Built for real-world encryption

Everything you need to encrypt user data at rest. Nothing you don't.

Encrypted I/O

writeFileSync auto-encrypts. readFileSync auto-decrypts. Your code doesn't change.

User Isolation

require('dark-envelope')(userId) — each user gets their own keyspace. Zero cross-contamination.

AES-256-GCM

Military-grade authenticated encryption. Tamper detection built in.

Zero Dependencies

Node.js crypto only. No npm supply chain risk. Nothing to audit but our code.

Drop-in Replacement

Same API as Node's fs module. Swap one require() and you're encrypted.

Ghost Fingerprints

Every user gets a unique fingerprint (PB-XXXX). Safe for logs. Reveals nothing about the key.

// Why Dark Envelope

How we compare

Feature Dark Envelope crypto (raw) node-forge
Drop-in fs replacement✔✘✘
Per-user key isolation✔ManualManual
Zero dependencies✔✔20+
Ghost fingerprints✔✘✘
Tamper detectionBuilt-inManualManual
Key rotation APIPro+DIYDIY
// Integration

Three steps to encrypted storage

1

Install

npm i dark-envelope
→
2

Replace require

require('dark-envelope')
→
3

Done

All data encrypted at rest
// Under the hood

The encryption pipeline

Step 1
Key Generation
256-bit
Step 2
HKDF-SHA256
per-operation key
Step 3
AES-256-GCM
authenticated
Step 4
At-Rest Storage
ciphertext

Every envelope carries a fingerprint, timestamp, IV, ciphertext, and auth tag. A sniffer sees noise. Your users see their data.

// Anatomy

Inside a Ghost Envelope

What your encrypted data looks like on disk. The d field is the mystery — the thing no one can read.

ghost-envelope.json
{
  "fp": "PB-K3N7A2B8", // public fingerprint
  "v": 1, // version
  "ts": 1741234567890, // timestamp (key derivation salt)
  "iv": "dGhpcyBpcyBh...", // initialization vector
  "d": "Y2lwaGVydGV4...", // ciphertext (your data, encrypted)
  "tag": "YXV0aGVudGlj..." // auth tag (tamper detection)
}

Built for Production

Dark Envelope secures every byte of user data across 14 specialized bots on PinkyBot.io.

Not a proof of concept. Battle-tested in production.

Download Dark Envelope →
AES-256-GCM • Zero dependencies • Node.js native crypto