enc

The contents of a backup, configuration file or exported user list may need to stay private even if someone obtains the file. enc creates an authenticated encrypted copy; without arguments it lists the authenticated ciphers available on this PHP server. It is not an archive and it does not calculate a shareable checksum.

SecurityVersion 1.1.5Stable
lil-terminal

Overview

To encrypt a file, run enc <src> and enter a password in the hidden prompt. The default output has the .enc suffix. For unattended use, -K <file> reads an exact key file; -k <hex> also works, but puts the key into the command line and possibly history. Use enc -info <file> to inspect cipher, format and header without unlocking the data.

Encryption is only as useful as key handling

Authenticated decryption validates the header and authentication tag before writing the result. Keep the password or exact key separate from the encrypted file, prefer hidden input for passwords, and use -w only when replacing the source file is genuinely intended.

Syntax

lil-terminal
enc · enc -info <file> · enc <src> [dst] [options]

Reference

enc

list authenticated ciphers supported by this server

enc -info <file>

show an encrypted-file header without decrypting

enc <src>

encrypt into <src>.enc through a hidden password prompt

enc <src> <dst>

encrypt into a destination file or directory

enc <src> -d

decrypt and remove .enc from the default output name

-k <hex>

use an exact hexadecimal key instead of a password

-K <file>

use an exact raw or hexadecimal key file

-a <cipher>

select an authenticated cipher; default aes-256-gcm

-i <n>

set PBKDF2 iterations; default 310000

-f

replace an existing destination

-w

replace the source file with the result

Notes

Minimum supports the simple file-to-file password workflow, but not switches such as -info, -K, -f or -w.

Interactive sandbox preview

Run the prepared examples directly on the page. Their results are prebuilt and shown in the browser; no terminal command is executed on the server.

Encrypt a file, then inspect its header

Install and manage

Install the current compatible version. Choose Base for the complete feature set or Minimum for the reduced package; use upgrade to update a module that is already installed.

Base and Minimum are two packages of the same current module release, not separate command versions.

Base package

Install the complete package with local command reference and every published mode.

install enc
Minimum package

Install the reduced package. Local reference is omitted; help <cmd> -i opens the current server reference.

install enc -m
Exact public version

Install exactly this published version.

install enc -v 1.1.5
Check or update

Ask upgrade to check compatibility and replace the installed block only when needed.

upgrade enc
Remove module

Remove the extension block while leaving the core and unrelated modules intact.

install enc -u

Examples

Examples are copyable command lines, not actions executed by this website. Review paths, permissions and destructive flags before running them on a real project.

Encrypt a file, then inspect its header
enc
Available algorithms depend on the PHP server. Example excerpt:
aes-128-gcm  aes-192-gcm  aes-256-gcm  chacha20-poly1305
Show an encrypted-file header without decrypting
enc -info \sandbox/secret.txt.enc
File           sandbox/secret.txt.enc
Format         LENC2
Cipher         aes-256-gcm
Authenticated  yes
Original size  36 B
Mode           0644
Encrypt into <src>.enc through a hidden password prompt
enc \sandbox/secret.txt
A hidden password or key prompt opens. The secret is not echoed.
Encrypt into a destination file or directory
enc \sandbox/secret.txt \sandbox/tmp/
A hidden password or key prompt opens. The secret is not echoed.
Use an exact raw or hexadecimal key file
enc \sandbox/data/users.json -K \sandbox/keys/data.key
Excerpt from directory listing:
sandbox/data/users.json.enc
Decrypt and remove .enc from the default output name
enc \sandbox/secret.txt.enc \sandbox/tmp/recovered.txt -d -K \sandbox/keys/data.key
Excerpt from directory listing:
sandbox/tmp/recovered.txt
Use an exact hexadecimal key instead of a password
enc \sandbox/data/users.json -k 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff
Excerpt from directory listing:
sandbox/data/users.json.enc
Select an authenticated cipher; default aes-256-gcm
enc \sandbox/data/users.json -k 00112233445566778899aabbccddeeff -a aes-128-gcm
Excerpt from directory listing:
sandbox/data/users.json.enc
Set PBKDF2 iterations; default 310000
enc \sandbox/secret.txt -i 400000
A hidden password or key prompt opens. The secret is not echoed.
Encrypt into a destination file or directory
enc \sandbox/secret.txt \sandbox/tmp/protected.enc -K \sandbox/keys/data.key
Destination already exists; use -f
Replace an existing destination
enc \sandbox/secret.txt \sandbox/tmp/protected.enc -K \sandbox/keys/data.key -f
Excerpt from directory listing:
sandbox/tmp/protected.enc
Reject a missing source file
enc \sandbox/tmp/work.txt -K \sandbox/keys/data.key -w
Excerpt from directory listing:
sandbox/tmp/work.txt
Replace the source file with the result
enc \sandbox/tmp/work.txt.enc -K \sandbox/keys/data.key -w -d
Excerpt from directory listing:
sandbox/tmp/work.txt.enc
Encrypt into <src>.enc through a hidden password prompt
enc \sandbox/missing.txt -K \sandbox/keys/data.key
Source file not found
Use an exact hexadecimal key instead of a password
enc \sandbox/secret.txt -k not-a-key
Hexadecimal key must contain exactly 64 characters
Set PBKDF2 iterations; default 310000
enc \sandbox/secret.txt -i 99
Iteration count must be between 10000 and 5000000
Use an exact raw or hexadecimal key file
enc \sandbox/secret.txt -K \sandbox/keys/no.key
Key file is not readable
Select an authenticated cipher; default aes-256-gcm
enc \sandbox/secret.txt -a aes-256-cbc
Cipher is unavailable or not authenticated
Replace the source file with the result
enc \sandbox/secret.txt \sandbox/tmp/other.enc -K \sandbox/keys/data.key -w
Choose either a destination or -w
Decrypt and remove .enc from the default output name
enc \sandbox/secret.txt -d -K \sandbox/keys/data.key
Encrypted file format not recognized

File used in this example: sandbox/data/sample.txt

The example uses a file or directory from the protected /sandbox/ documentation workspace.

lil-terminal sandbox text file

This file is safe to read, copy, rename, replace, hash and archive.

Related documentation

Is lil-terminal safe to leave on a production site? →How does authorization work? →

Current public release

v1.1.52026-11-01

Production refinement

Current stable release of enc. The contents of a backup, configuration file or exported user list may need to stay private even if someone obtains the file.

# Version history