sentinelphp/encrypt

Sodium-based encryption library for sensitive data

v1.0.1 2026-04-27 12:16 UTC

Requires

• php: >=8.2
• ext-sodium: *

Requires (Dev)

• phpstan/phpstan: ^2.0
• phpunit/phpunit: ^11.0 || ^12.0

GPL-3.0-or-later

• SentinelPHP Contributors

• security
• encryption
• sodium
• data-protection

README

Sodium-based encryption library for sensitive data protection.

Installation

composer require sentinelphp/encrypt

Requirements: PHP 8.2+ with the sodium extension.

Usage

use SentinelPHP\Encrypt\Encryptor;

// Generate a new encryption key
$key = Encryptor::generateKey();

// Create encryptor with the key
$encryptor = new Encryptor($key);

// Encrypt data
$plaintext = 'sensitive data';
$ciphertext = $encryptor->encrypt($plaintext);

// Decrypt data
$decrypted = $encryptor->decrypt($ciphertext);

Key Management

use SentinelPHP\Encrypt\Encryptor;

// Generate a new key (base64-encoded)
$key = Encryptor::generateKey();
// Store this securely (e.g., environment variable, secrets manager)

// Check if encryption is enabled
$encryptor = new Encryptor($key);
if ($encryptor->isEnabled()) {
    $encrypted = $encryptor->encrypt($data);
}

Security

This library uses:

• XSalsa20-Poly1305 authenticated encryption
• Random nonces for each encryption operation
• Constant-time comparison for authentication

Error Handling

use SentinelPHP\Encrypt\Encryptor;
use SentinelPHP\Encrypt\Exception\EncryptionException;
use SentinelPHP\Encrypt\Exception\InvalidKeyException;

try {
    $encryptor = new Encryptor($key);
    $decrypted = $encryptor->decrypt($ciphertext);
} catch (InvalidKeyException $e) {
    // Invalid or missing encryption key
} catch (EncryptionException $e) {
    // Encryption/decryption failed (tampered data, wrong key, etc.)
}

License

GPL v3 — see LICENSE for details