v1.7 • Utils • 5kb gzipped • MIT
VaultBox
Encrypted local storage over the Web Crypto API, with key rotation and an expiry policy.
// why vaultbox
Encryption you do not implement
Keys are derived and stored through Web Crypto as non-extractable material. VaultBox never touches raw key bytes.
// stack
Honest about the threat model
Protects data at rest against another script reading storage. It is not a defence against a compromised page, and the documentation says so plainly.
VaultBox started as a single file in a client project and stayed small on purpose. It does one job, it does it in 5kb gzipped, and it has no runtime dependencies.
Getting started
Install it, import it, call it:
npm i vaultbox-jsKeys are derived and stored through Web Crypto as non-extractable material. VaultBox never touches raw key bytes.
What it does not do
It does not manage your state, style your components or ship a plugin system. Those are your decisions, and keeping them out is what keeps the bundle honest.
- Non-extractable keys
- Expiry and rotation
- MIT licensed, commercially friendly
Features
Non-extractable keys
Derived through PBKDF2 and held as opaque CryptoKey objects.
Expiry and rotation
Entries can expire, and rotating a key re-wraps existing values in place.
Tested to the edges
Ninety-eight percent branch coverage, with the awkward cases written first.
Node and browser
One build runs in both, with no conditional exports to get wrong.
Documented properly
Every public function has a worked example, not just a signature.
ESM and types
Ships module and CommonJS builds with hand-written type definitions and source maps.
Get VaultBox v1.7
6 files • .min.js 5kb • .zip 79kb • sha384 verified
Changelog
- Key rotation without data loss
- Per-entry expiry policy
- Threat model documented explicitly
- Node 18 is now the minimum supported version
- CommonJS build restored for older bundlers
- Reworked the public API for consistency
- Deprecated helpers removed
// related
Related products
ChartForge
Canvas charts in twelve lines. Responsive, accessible and dark-mode ready, with no D3 learning curve.
View →MotionEase
Physics-based micro-animations with a single call. Spring curves that feel right without a tuning session.
View →FormFlow
Validation and multi-step logic that works the same in React, Vue and vanilla. Your markup stays yours.
View →Drop it in this afternoon.
MIT licensed. Commercial friendly. Five-minute setup.