The pieces we kept rewriting, published properly

Application crypto usually fails not because the primitives are weak, but because the wiring around them is wrong: a nonce reused, a key with no rotation path, a ciphertext that cannot be decrypted after a deploy. encryptix is built around those failure modes rather than around the algorithm list.

Keys are purpose-scoped through HKDF, so a key derived for one context cannot silently decrypt another. Rotation produces payloads that stay backward-compatible, so old ciphertexts keep working after you turn the key over. Key fingerprinting makes multi-key debugging tractable. AES-SIV covers the deterministic-encryption case you need for searchable fields, where a random nonce would make lookups impossible.

It ships with zero runtime dependencies and runs on Node 18+, browsers, Cloudflare Workers, Deno, and Vercel Edge from the same import — because it is built on Web Crypto rather than Node internals.

Almost every codebase grows its own `generateToken` helper, and most of them are subtly biased — a modulo over random bytes skews the character distribution, which quietly reduces the entropy you thought you had. strio does the rejection sampling properly so the output is uniform.

Beyond raw tokens it covers the shapes you actually reach for: prefixed record IDs with a checksum (`usr_K3xP9mQr2L4Xc`), human-memorable passphrases, patterned codes from a template like `####-AAAA-####`, and expiring tokens that hand back both the token and its expiry. An entropy calculator tells you how strong a given configuration really is.

It doubles as a general string toolkit — 60-plus helpers for casing, truncation, slugs, padding, and comparison — so it tends to replace two or three small dependencies at once. There is a CLI too, usable straight through npx with no install.