SOFTWARE

CLI Guide

A single strcrypt executable encrypts and decrypts strings, files, and record lists. No additional libraries are needed.

0.3.1Updated 2026-09-27MIT · Linux x86_64 · Windows x64

Install

Linux (bash)

mkdir -p ~/strcrypt && cd ~/strcrypt
curl -fLO https://www.cubiware.co.kr/api/download/strcrypt/0.3.1/strcrypt
curl -fLO https://www.cubiware.co.kr/api/download/strcrypt/0.3.1/strcrypt.hmac
curl -fLO https://www.cubiware.co.kr/api/download/strcrypt/0.3.1/SHA256SUMS
sha256sum -c --ignore-missing SHA256SUMS
chmod +x strcrypt
export PATH="$HOME/strcrypt:$PATH"
strcrypt --version

Windows (PowerShell)

New-Item -ItemType Directory -Force $HOME\strcrypt | Out-Null
cd $HOME\strcrypt
curl.exe -fLO https://www.cubiware.co.kr/api/download/strcrypt/0.3.1/strcrypt.exe
curl.exe -fLO https://www.cubiware.co.kr/api/download/strcrypt/0.3.1/strcrypt.exe.hmac
curl.exe -fLO https://www.cubiware.co.kr/api/download/strcrypt/0.3.1/SHA256SUMS
Get-Content SHA256SUMS | ForEach-Object {
  $hash, $name = $_ -split '\s+', 2
  if (Test-Path $name) {
    if ((Get-FileHash $name -Algorithm SHA256).Hash -eq $hash) { "$($name): OK" } else { "$($name): FAILED" }
  }
}
$env:Path = "$HOME\strcrypt;$env:Path"
strcrypt --version

Keep strcrypt.hmac (strcrypt.exe.hmac on Windows) in the same directory as the executable, and move them together if you relocate the executable. The examples below use bash. The commands and options are the same on Windows.

Set up the key

Linux (bash)

(umask 077; openssl rand -base64 32 | head -c 32 > strcrypt.key)
export STRCRYPT_KEY_FILE="$PWD/strcrypt.key"

Windows (PowerShell)

$key = Join-Path $PWD 'strcrypt.key'
$bytes = [byte[]]::new(24)
[Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($bytes)
[IO.File]::WriteAllText($key, [Convert]::ToBase64String($bytes))
icacls $key /inheritance:r /grant:r "$($env:USERNAME):F"
$env:STRCRYPT_KEY_FILE = $key

Key rules and backup advice are in Quick start on the overview page.

Encrypt and decrypt strings

strcrypt encrypt -c "alice@example.com"
CT=$(strcrypt encrypt -c "alice@example.com" | awk '$1 == "Base64:" {print $2}')
strcrypt decrypt -c "$CT"

Sample encrypt output (CLI messages are in Korean; the ciphertext changes on every run)

알고리즘:         ARIA-256-GCM
평문:             alice@example.com
암호문 크기:      46바이트 (헤더 1 + nonce 12 + 암호화 데이터 17 + 태그 16)
Base64:           AhKjxhJpz8uPwj8Rbq849CywCxDUNHkKfaBt8FWPdv3LqtQwG/lebCDZ7wOktw==

Option	Effect
`-c`	Print to the screen only, without saving a file.
`-q`	Save to a file only, without printing to the screen.
`-o <path>`	Set the output file path. Defaults are ./strcrypt_enc.bin and ./strcrypt_dec.txt.

Encrypt and decrypt files

strcrypt encrypt-file -i report.csv -o report.csv.enc
strcrypt decrypt-file -i report.csv.enc -o report.dec.csv
strcrypt migrate-file -i report.csv.enc -o report.seed.enc -t seed128gcm

Large files are processed in chunks instead of being loaded into memory at once. migrate-file decrypts a file and writes a new file encrypted with the algorithm given in -t.

Batch processing

Use this when you have many records, such as values exported from a database. Each line is one record, written as Base64. Use base64 -w0 so each value is encoded without line breaks. Results come out one line per record, in input order.

printf '%s\n' "$(printf 'alice@example.com' | base64 -w0)" "$(printf 'bob@example.com' | base64 -w0)" > rows.b64
strcrypt encrypt-batch -i rows.b64 -o rows.enc
strcrypt decrypt-batch -i rows.enc | while read -r line; do printf '%s' "$line" | base64 -d; echo; done

Per-record AAD

AAD (additional authenticated data) is not encrypted but is authenticated together with the ciphertext. If you use the row ID as AAD, decryption fails when a ciphertext from another row is pasted in. With --format tsv, data and AAD are separated by a tab, and the AAD stays unchanged in the second column of the output.

printf '%s\t%s\n' "$(printf 'alice@example.com' | base64 -w0)" "$(printf 'id=1' | base64 -w0)" > rows.tsv
strcrypt encrypt-batch --format tsv -i rows.tsv -o rows_aad.enc
strcrypt decrypt-batch --format tsv -i rows_aad.enc | cut -f1 | base64 -d; echo

Option	Effect
`--format b64\|tsv`	b64 takes one Base64 value per line. tsv takes data Base64 and AAD Base64 separated by a tab. Default: b64.
`-i, -o`	Input and output files. Standard input and output are used when omitted.
`--chunk-size`	Maximum number of records processed at once. Default: 500.
`--max-chunk-bytes`	Upper limit on the total input bytes processed at once. Default: 104857600.
`--threads`	Number of parallel threads. Falls back to RAYON_NUM_THREADS, then to the number of logical CPUs. Values above the number of available CPUs are reduced to that number.

Processing stops at the first error. The -o file is replaced only when every record succeeds.

Exit code	Meaning
`0`	Success
`1`	Record data error (Base64 format, field count, authentication failure, and so on). The message includes the line number.
`2`	Usage error in options or values
`3`	Configuration error (key could not be loaded, or the algorithm is not allowed in the current mode)
`4`	I/O or process error

Choose an algorithm and mode

strcrypt info
strcrypt -a seed128gcm encrypt -c "alice@example.com"
strcrypt --mode non-approved -a aes256gcm encrypt -c "alice@example.com"

-a selects the encryption algorithm. The default mode allows only aria256gcm, seed128gcm, and lea128gcm. Other algorithms need --mode non-approved. The full list is in Algorithms and modes. strcrypt info shows the module state; if the module is in an error state (for example, a failed self-test or integrity check), it shows the cause and exits with code 1.

Command reference

Command	Effect
`encrypt [TEXT]`	Encrypts a string, prints it as Base64, and also saves it to ./strcrypt_enc.bin.
`decrypt [DATA]`	Decrypts a Base64 ciphertext. With -f, it reads from a file (-i).
`encrypt-file -i -o`	Encrypts a file while reading it in chunks.
`decrypt-file -i -o`	Decrypts a file created by encrypt-file.
`migrate-file -i -o -t`	Re-encrypts an encrypted file with a different algorithm.
`encrypt-batch`	Reads one record per line and encrypts them in input order.
`decrypt-batch`	Decrypts encrypt-batch output line by line.
`info`	Shows the supported algorithms and key status.

Run strcrypt <command> --help to see every option of a command.

Environment variables

Name	Purpose
`STRCRYPT_KEY_FILE`	Path to the key file. The file permission must be 0600.
`STRCRYPT_KEY`	Key value (1 to 32 bytes). Used when STRCRYPT_KEY_FILE is not set.
`STRCRYPT_MODE`	Set to non-approved to allow all eight algorithms.
`RAYON_NUM_THREADS`	Number of parallel threads for batch commands. --threads takes precedence.

Troubleshooting

Some messages from the library are shown in Korean even in an English locale.

Symptom	What to do
키 파일 권한은 0600 이어야 합니다	Fix the permission with chmod 600 strcrypt.key.
STRCRYPT_KEY is required	Run the command from a shell where STRCRYPT_KEY_FILE or STRCRYPT_KEY is set.
현재 모드(korean-standard)에서 허용되지 않는 알고리즘 (algorithm not allowed in the current mode)	Specify algorithms other than the Korean standards together with --mode non-approved.
IntegrityFailure	The executable and its .hmac file (strcrypt and strcrypt.hmac, or strcrypt.exe and strcrypt.exe.hmac) do not match. Download both files again and check their SHA-256.