amaro

Fernet and Branca token encryption for Gleam.

gleam add amaro

Fernet

Fernet tokens use AES-128-CBC with HMAC-SHA256. Tokens are base64url-encoded.

import amaro/fernet

let key = fernet.generate_key()
let token = fernet.encrypt(key, plaintext: <<"too many secrets":utf8>>)
let assert Ok(plaintext) = fernet.decrypt(key, token:)

Enforce a maximum token age:

import gleam/time/duration

let assert Ok(plaintext) =
  fernet.decrypt_with_ttl(key, token:, ttl: duration.seconds(60))

Keys serialize as base64url strings:

let encoded = fernet.key_to_string(key)
let assert Ok(key) = fernet.key_from_string(encoded:)

Branca

Branca tokens use XChaCha20-Poly1305 authenticated encryption. Tokens are base62-encoded.

import amaro/branca

let key = branca.generate_key()
let token = branca.encrypt(key, plaintext: <<"too many secrets":utf8>>)
let assert Ok(plaintext) = branca.decrypt(key, token:)

Enforce a maximum token age:

import gleam/time/duration

let assert Ok(plaintext) =
  branca.decrypt_with_ttl(key, token:, ttl: duration.seconds(60))

Keys are raw 32-byte values:

let bytes = branca.key_to_bytes(key)
let assert Ok(key) = branca.key_from_bytes(bytes:)