Cryptek
Secure file encryption for the command line
Version 0.26.3 • Checksums
Security Features
AES-256-GCM
Industry-standard authenticated encryption providing both confidentiality and integrity.
Argon2id
Memory-hard key derivation that resists GPU and ASIC attacks. 64MB memory, 2 iterations.
Encrypted Headers
All metadata hidden inside encrypted blocks. Files appear as pure random data.
Anti-Fingerprinting
Variable header sizes (64-512 bytes) prevent file type identification.
Filename Hiding
Original filename stored in encrypted header. Optional random output names.
Secure Deletion
Overwrite files before removal. HDD: 3-pass, SSD: re-encrypt then delete.
RAM Decryption
Decrypt to RAM filesystem — data never touches disk storage. Linux and macOS.
Folder Encryption
Encrypt entire directories as tar archives with optional gzip compression.
Keyfile Support
Generate a 256-bit keyfile and use it alone — or combined with a password so both are required to decrypt.
String Encryption
Encrypt text snippets straight from the terminal. Base64 or hex output for secrets, notes, and config values.
Stealth Mode
Random output filename plus hidden file attribute. The real name travels inside the encrypted header.
Downgrade Protection
Key derivation parameters are validated against strict minimums — a tampered file cannot force weak KDF settings.
Steganography
Hide an encrypted file inside an ordinary-looking PNG, JPEG, BMP, TIFF, or WAV — pixel and audio-sample LSBs, or JPEG DCT coefficients with selectable schemes. Carrier metadata preserved. Concealment against casual inspection, not confidentiality.
Pixel-Cipher Visualizer
Educational: encipher only an image’s pixels so the result stays viewable — and you see the cipher work. AES-ECB leaks the picture (the “ECB penguin”), CTR/CBC/ChaCha20 turn it into noise. Works on PNG, uncompressed BMP and TIFF, and on baseline JPEG — which has no pixel domain at all, so it is enciphered in its DCT coefficients instead. The output always keeps the input’s format. BMP and TIFF recover byte-for-byte; a recovered JPEG is identical in every coefficient while ~98% of its bytes differ, because the entropy stream is re-serialised. Not a way to secure an image; every run says so.
Sample-Cipher Visualizer
The same idea for audio — and this one you hear. Encipher only a WAV’s PCM samples and it stays a playable file of the same duration. Digital silence is a run of identical samples, so AES-ECB maps it to identical ciphertext blocks: a periodic waveform you hear as a steady buzz wherever the original was quiet, while CTR, CBC and ChaCha20 give uniform noise. The metrics say it plainly — on the demo voiceover ECB reads entropy 7.85, which looks random, yet keeps the original’s duplicate-block rate of 19.7% exactly; shuffle leaves entropy identical to the original, because scrambling position is not encryption. Recovery is byte-for-byte exact. Not a way to secure audio, and re-encoding to MP3 or AAC destroys the ciphertext. Turn your volume down first.
Installation
One-Line Install
Automatically detects your OS and architecture.
curl -sSL https://hperez.dev/cryptek/install.sh | bash
Review the script before running.
Manual Install
Download the archive above, then extract and move the binary.
tar -xzf cryptek_*.tar.gz
sudo mv cryptek /usr/local/bin/Quick Start
Run cryptek --help for all commands and options.