sec-encrypt-aes Edge Function — Security

sec-encrypt-aes — Encrypt strings with AES-256-GCM

Encrypts any string with AES-256-GCM via the Web Crypto API. Key can be any length — it's SHA-256 hashed internally to produce a 256-bit key.

---

API

POST /api/sec-encrypt-aes

Request body

Field	Type	Required	Description
text	string	✅	Plaintext to encrypt
key	string	✅	Encryption passphrase (any length)

Success response (200)

{
  "success": true,
  "data": {
    "encrypted": "dGVzdGl2MTI=:dGVzdGNpcGhlcnRleHQ="
  }
}

Error responses

Code	HTTP	When
INVALID_INPUT	400	Missing text or key
INTERNAL_ERROR	500	Unexpected error

---

Usage

cURL

curl -X POST "$FUNCTION_URL" \
  -H "Content-Type: application/json" \
  -d '{"text": "sensitive data", "key": "my-passphrase"}'

TypeScript / JavaScript (HTTP)

const response = await fetch(FUNCTION_URL, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ text: 'sensitive data', key: 'my-passphrase' }),
});
const { data } = await response.json();
console.log(data.encrypted); // store this, pass to sec-decrypt-aes to recover

Direct import (Node / Bun / Deno)

import { encryptAes } from '@aerostack/functions/sec-encrypt-aes';

const { encrypted } = await encryptAes({ text: 'sensitive data', key: 'my-passphrase' });

---

Use Cases

• Encrypting PII (emails, phone numbers) before storing in a database
• Wrapping short-lived tokens or secrets for secure transport in URL parameters
• Storing encrypted user preferences or configuration blobs
• Encrypting webhook payloads for secure delivery

---

Notes

• Uses AES-256-GCM — provides both confidentiality and authenticity (AEAD)
• A random 12-byte IV is generated for every encryption — same plaintext always produces different ciphertext
• The output bundle format is base64(iv):base64(ciphertext+authTag) — self-contained, no state needed
• Pair with sec-decrypt-aes to reverse — use the same key string
• Auth tag is embedded in the ciphertext — tampering is detected on decryption