rypt.dev

Questions from the bench

How do I get started with rypt.dev?

Sign in at dashboard.rypt.dev to create your account. Create a key by giving it a name and choosing its tier. Issue an API key (shown once and cannot be recovered), and then make your first encrypt or decrypt call. The dashboard shows example code in curl, Node and Python.

What is the difference between direct mode and envelope mode?

Direct mode is for encrypting and decrypting values directly: you send the value and store what comes back. Envelope mode is for files and large objects: you ask for a data key, encrypt the data with it in your own code, keep only the wrapped key beside the data, and unwrap it when you need to read.

How are keys held and where do they live?

Keys are held by rypt and never reach your servers. You hold an API key that can use them, create, rotate and delete keys in your account. Free and Extra wrapped keys are held by rypt and wrapped by an HSM root key. Software keys are dedicated keys protected in software. Hardware keys are dedicated keys in a hardware security module.

What happens to my data and plaintext at rypt?

Your plaintext reaches rypt so it can be encrypted, and rypt holds the keys that decrypt it. This is not zero-knowledge. If that rules it out for you, use a key management service in your own cloud account instead.

How are operations counted and what is the pricing for overages?

Only the five operations (encrypt, decrypt, wrap, unwrap, rewrap) are counted, and only once the cryptography succeeds. Free keys include 10,000 monthly operations and refuse requests after that until reset. Extra wrapped keys include 50,000 and cost $0.10 per 10,000 additional. Software keys include 100,000 and cost $0.20 per 10,000 additional. Hardware keys include 250,000 and cost $0.50 per 10,000 additional.