PHP code example of temant / encryption-manager

    
        
<?php
require_once('vendor/autoload.php');

/* Start to develop here. Best regards https://php-download.com/ */

    

temant / encryption-manager example snippets

use Temant\EncryptionManager\EncryptionManager;

// The secret should be a high-entropy value (e.g. a 32+ byte random string from your
// app's secrets manager), not a human password.
$encryption = new EncryptionManager('your-high-entropy-app-secret');

$encrypted = $encryption->encryptString('Hello, World!');
$decrypted = $encryption->decryptString($encrypted);

echo "Encrypted: $encrypted\n";
echo "Decrypted: $decrypted\n";

$plainText = 'Sensitive Data';
$password = 'your-secure-password';

$encrypted = $encryption->encryptString($plainText, $password);
$decrypted = $encryption->decryptString($encrypted, $password);

use Temant\EncryptionManager\Crypto\EncryptionCipher;
use Temant\EncryptionManager\Crypto\EncryptionConfig;

$config = new EncryptionConfig(
    cipher: EncryptionCipher::AES_128_GCM, // or AES_256_GCM (default)
    pbkdf2Iterations: 250_000,             // default: 150_000
    saltBytes: 16,                         // default: 16
    tagBytes: 16,                          // default: 16
    hkdfInfo: 'my-app-name',               // default: "temant-encryption"
);

$encryption = new EncryptionManager('your-app-secret', $config);

$encryption = new EncryptionManager('current-secret');
$oldPayload = $encryption->encryptString('archived data');

// Later, e.g. during a scheduled secret rotation:
$encryption->updateSecret('new-secret'); // old-secret is retired, not discarded

$encryption->decryptString($oldPayload);       // still works (retired key)
$encryption->encryptString('new data');        // uses new-secret

$encryption->updateSecret('new-secret', retireCurrent: false);

$encryption = new EncryptionManager('current-secret', retiredSecrets: ['secret-from-2025-q4']);
// or:
$encryption->addRetiredSecret('secret-from-2025-q4');

// To permanently drop the keyring (old data becomes undecryptable):
$encryption->clearRetiredSecrets();

$encryption->encryptFile('path/to/input/file.txt', 'path/to/encrypted/file.txt', 'file-password');
$encryption->decryptFile('path/to/encrypted/file.txt', 'path/to/decrypted/file.txt', 'file-password');

$encryption->encryptStreamedFile('path/to/large-input.bin', 'path/to/large-output.enc');
$encryption->decryptStreamedFile('path/to/large-output.enc', 'path/to/large-decrypted.bin');

// Optional password mode and a custom chunk size:
$encryption->encryptStreamedFile($input, $output, password: 'file-password', chunkSize: 1024 * 1024);

use Temant\EncryptionManager\EncryptionException;

try {
    $encryption->decryptString($payload, $password);
} catch (EncryptionException $e) {
    // Never assume a caught exception means "wrong password" specifically —
    // the same exception type covers tampering, corruption, and config mismatches.
    log($e->getMessage());
}