# cryptek(1) - File Encryption Tool

## SYNOPSIS

```
cryptek <command> [options] [arguments]
```

## DESCRIPTION

**cryptek** is a CLI tool for encrypting and decrypting files using AES-256-GCM
authenticated encryption.

Encrypted files are saved with a `.ctk` extension. Key derivation uses
Argon2id by default (memory-hard, GPU/ASIC resistant).

## COMMANDS

### decrypt

```
cryptek decrypt <files...>
```

Decrypt one or more .ctk files previously encrypted with Cryptek.

Decrypts files encrypted with Cryptek (v6 format).
The original filename is restored from the encrypted header.

Examples:
  cryptek decrypt file.ctk --stdin       Decrypt with secure prompt
  cryptek decrypt *.ctk -s               Decrypt multiple files
  cryptek decrypt file.ctk -o out.txt    Decrypt to specific path
  cryptek decrypt file.ctk --tmpfs       Decrypt to RAM (never touches disk)
  cryptek decrypt archive.tar.ctk -x     Decrypt and extract folder

**Options:**

- `-x`, `--extract`: Extract tar archive after decryption (for folder archives)
- `-k`, `--keep`: Keep the original/encrypted file
- `-K`, `--keyfile` *KEYFILE*: Use keyfile as key material (can be combined with password)
- `-o`, `--output` *OUTPUT*: Output file path (use - for stdout)
- `-P`, `--password` *PASSWORD*: Password for encryption/decryption (visible in process list)
- `-S`, `--secure-delete`: Securely delete files (overwrite before removal)
- `-s`, `--stdin`: Read password from stdin (secure, not visible in process list)
- `-T`, `--tmpfs`: Decrypt to RAM-based tmpfs (Linux/macOS only, data never touches disk)

### encrypt

```
cryptek encrypt <files...>
```

Encrypt one or more files using AES-256-GCM authenticated encryption.

Encrypted files are saved with a .ctk extension. The original filename is stored
inside the encrypted header for privacy (document.pdf → document.ctk → document.pdf).

Examples:
  cryptek encrypt file.txt --stdin           Encrypt with secure prompt
  cryptek encrypt file1.txt file2.txt -s     Encrypt multiple files
  cryptek encrypt "*.txt" --keyfile key.bin  Encrypt with glob pattern
  cryptek encrypt --folder mydir --compress  Encrypt folder as archive
  cryptek encrypt file.txt -P mypassword     Encrypt with explicit password

**Options:**

- `-z`, `--compress`: Compress folder with gzip before encryption (requires --folder)
- `-f`, `--folder`: Treat input as folder and encrypt as tar archive
- `-H`, `--hide-file`: Hide encrypted output file from directory listings (dot prefix)
- `-N`, `--hide-name`: Generate random output filename (original name stored in encrypted header)
- `--kdf` *KDF*: Key derivation function: argon2id, pbkdf2
- `-k`, `--keep`: Keep the original/encrypted file
- `-K`, `--keyfile` *KEYFILE*: Use keyfile as key material (can be combined with password)
- `-P`, `--password` *PASSWORD*: Password for encryption/decryption (visible in process list)
- `-S`, `--secure-delete`: Securely delete files (overwrite before removal)
- `-s`, `--stdin`: Read password from stdin (secure, not visible in process list)
- `--stealth`: Maximum concealment: random filename + hidden from listings (combines --hide-name and --hide-file)

### hash

```
cryptek hash <files...>
```

Calculate and display the SHA-256 hash of one or more files.

Examples:
  cryptek hash file.txt
  cryptek hash file1.txt file2.txt
  cryptek hash "*.txt"

### hashes

```
cryptek hashes
```

Display all available hash algorithms that can be used with the hash command.

### kdfs

```
cryptek kdfs
```

Display all available KDF algorithms that can be used with the --kdf flag.

### keygen

```
cryptek keygen <output-file>
```

Generate a cryptographically secure random keyfile for use with --keyfile flag.

The generated keyfile contains 32 bytes (256 bits) of random data, providing
maximum entropy for AES-256 encryption.

Example usage:
  cryptek keygen mykey.bin
  cryptek encrypt secret.txt --keyfile mykey.bin
  cryptek decrypt secret.ctk --keyfile mykey.bin

Store the keyfile securely - anyone with access to it can decrypt your files.
Consider storing it on a separate device (USB drive) for two-factor security.

**Options:**

- `-n`, `--size` *SIZE*: Size of keyfile in bytes (default: 32, min: 16, max: 1024)

### reveal

```
cryptek reveal <file>
```

Decrypt a .ctk file and print its contents to stdout without creating a file.
Useful for viewing encrypted text files without leaving a decrypted copy on disk.

Key material can be provided via (in order of precedence):
  - --stdin: Secure password prompt (recommended, not visible in process list)
  - --password/-P: Password flag (visible in process list)
  - --keyfile: Use a file as key material (must match encryption)
  - CRYPTEK_KEY environment variable

**Options:**

- `-K`, `--keyfile` *KEYFILE*: Use keyfile as key material (can be combined with password)
- `-P`, `--password` *PASSWORD*: Password for encryption/decryption (visible in process list)
- `-s`, `--stdin`: Read password from stdin (secure, not visible in process list)

### string

```
cryptek string <command>
```

Encrypt or decrypt text strings using AES-256-GCM.

Output is encoded as base64 (default) or hex for safe terminal/clipboard use.
Input text can be provided via --text flag or piped through stdin.

Subcommands:
  encrypt    Encrypt a text string
  decrypt    Decrypt a text string

Security note: --text and -P flags are visible in process listings (ps aux).
For sensitive data, pipe text via stdin and use --stdin for the password.

Examples:
  cryptek string encrypt --text "hello world" -P mypassword
  cryptek string decrypt --text "base64data..." -P mypassword
  echo "hello" | cryptek string encrypt -P mypassword --format hex
  cryptek string encrypt --text "secret" -s --format base64

### version

```
cryptek version
```

Display the version, commit hash, and build date of Cryptek.

## KEY MATERIAL

Key material can be provided via (in order of precedence):

1. `--stdin` flag (secure prompt, recommended)
2. `--password`/`-P` flag (visible in process list)
3. `--keyfile` flag (file containing key material)
4. `CRYPTEK_KEY` environment variable

## EXAMPLES

```bash
# Encrypt a file with secure password prompt
cryptek encrypt secret.txt --stdin

# Encrypt multiple files
cryptek encrypt file1.txt file2.txt file3.txt -s

# Decrypt a file
cryptek decrypt secret.ctk --stdin

# Encrypt using a keyfile
cryptek encrypt secret.txt --keyfile mykey.bin

# Encrypt all .txt files with glob pattern
cryptek encrypt "*.txt" --stdin

# Encrypt a folder
cryptek encrypt --folder /path/to/dir --stdin

# Hash files (SHA-256)
cryptek hash file1.txt file2.txt

# Generate a keyfile
cryptek keygen mykey.bin

# Encrypt with hidden filename (output: random hex name)
cryptek encrypt secret.pdf --hide-name --stdin

# Encrypt and hide from directory listings (dot prefix)
cryptek encrypt secret.pdf --hide-file --stdin

# Maximum concealment: random name + hidden from listings
cryptek encrypt secret.pdf --stealth --stdin

# Encrypt a string
cryptek string encrypt --text "hello world" -P mypassword

# Decrypt a string
cryptek string decrypt --text "base64data..." -P mypassword
```

## ENVIRONMENT

- `CRYPTEK_KEY`: Default password when not provided via other methods

## EXIT STATUS

- `0`: Success
- `1`: Error or operation cancelled

## SEE ALSO

gpg(1), openssl(1), age(1)
