PHPackages                             3ncr/tokencrypt-php - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. 3ncr/tokencrypt-php

ActiveLibrary[Security](/categories/security)

3ncr/tokencrypt-php
===================

Implementation of 3ncr.org V1 token(strings) encryption standard.

2.0.0(2mo ago)219.0k↓45.2%1[2 PRs](https://github.com/3ncr/tokencrypt-php/pulls)MITPHPPHP >=8.1CI passing

Since Nov 19Pushed 2w ago1 watchersCompare

[ Source](https://github.com/3ncr/tokencrypt-php)[ Packagist](https://packagist.org/packages/3ncr/tokencrypt-php)[ RSS](/packages/3ncr-tokencrypt-php/feed)WikiDiscussions master Synced 2d ago

READMEChangelog (7)Dependencies (4)Versions (20)Used By (0)

tokencrypt-php (3ncr.org)
=========================

[](#tokencrypt-php-3ncrorg)

[![Lint & Test](https://github.com/3ncr/tokencrypt-php/actions/workflows/lint-and-test.yml/badge.svg)](https://github.com/3ncr/tokencrypt-php/actions/workflows/lint-and-test.yml)[![Latest Stable Version](https://camo.githubusercontent.com/86059f9a12abd8f1ab1cf1b18b34a0b6c7dffa424a549ca99727e75ae07a7623/68747470733a2f2f706f7365722e707567782e6f72672f336e63722f746f6b656e63727970742d7068702f762f737461626c65)](https://packagist.org/packages/3ncr/tokencrypt-php)[![Total Downloads](https://camo.githubusercontent.com/333374bd78b9b3e9c1732d001de4af33db8570b59303ea72960a701082a8f8f2/68747470733a2f2f706f7365722e707567782e6f72672f336e63722f746f6b656e63727970742d7068702f646f776e6c6f616473)](https://packagist.org/packages/3ncr/tokencrypt-php)[![OpenSSF Scorecard](https://camo.githubusercontent.com/f0a2c7bab64bb7f775c9205f1854ca6f1ac50ecd0c01bce01321b6395e1fdcc2/68747470733a2f2f6170692e73636f7265636172642e6465762f70726f6a656374732f6769746875622e636f6d2f336e63722f746f6b656e63727970742d7068702f6261646765)](https://scorecard.dev/viewer/?uri=github.com/3ncr/tokencrypt-php)[![License: MIT](https://camo.githubusercontent.com/abb083f86b231716511878d9e9e6b983371dc4361662b73dbeece20b4539b8b0/68747470733a2f2f706f7365722e707567782e6f72672f336e63722f746f6b656e63727970742d7068702f6c6963656e7365)](https://packagist.org/packages/3ncr/tokencrypt-php)

[3ncr.org](https://3ncr.org/) is a tiny encrypted-string format for config values, tokens, and app secrets — encrypt a UTF-8 string in one language, store it as a recognizable value, and decrypt it in another. v1 uses AES-256-GCM for authenticated encryption with a 12-byte random IV:

```
3ncr.org/1#

```

Encrypted values look like `3ncr.org/1#pHRufQld0SajqjHx+FmLMcORfNQi1d674ziOPpG52hqW5+0zfJD91hjXsBsvULVtB017mEghGy3Ohj+GgQY5MQ`.

This is the PHP 8.1+ implementation. See [github.com/3ncr](https://github.com/3ncr) for implementations in other languages (Go, Node.js, Python, Rust, Java, C#, Ruby).

Install
-------

[](#install)

```
composer require 3ncr/tokencrypt-php
```

Requires PHP 8.1+ with `ext-openssl`, `ext-json`, and `ext-sodium` (the last is used for Argon2id key derivation).

Usage
-----

[](#usage)

Pick a constructor based on the entropy of your secret — see the [3ncr.org v1 KDF guidance](https://3ncr.org/1/#kdf) for the canonical recommendation.

### Recommended: raw 32-byte key (high-entropy secrets)

[](#recommended-raw-32-byte-key-high-entropy-secrets)

If you already have a 32-byte AES-256 key (random key, API token hashed to 32 bytes via SHA3-256, etc.), skip the KDF and pass it directly.

```
$key = random_bytes(32);                              // or: load from env / secret store
$tokenCrypt = \ThreeEncr\TokenCrypt::fromRawKey($key);
```

### Recommended: Argon2id (passwords / low-entropy secrets)

[](#recommended-argon2id-passwords--low-entropy-secrets)

For passwords or passphrases, use `fromArgon2id`. It uses the parameters recommended by the [3ncr.org v1 spec](https://3ncr.org/1/#kdf)(`m=19456 KiB, t=2, p=1`). The salt must be exactly 16 bytes (libsodium's `crypto_pwhash` requirement, which matches the spec's "at least 16 random bytes" recommendation at its minimum length and is interoperable with the Go and Node implementations when the same salt is used).

```
$tokenCrypt = \ThreeEncr\TokenCrypt::fromArgon2id($password, $salt);
```

### Legacy: PBKDF2-SHA3 (existing data only)

[](#legacy-pbkdf2-sha3-existing-data-only)

The original `(secret, salt, iterations)` constructor is kept for backward compatibility with data encrypted by earlier versions. It is deprecated — prefer `fromRawKey` or `fromArgon2id` for new code.

```
$tokenCrypt = new \ThreeEncr\TokenCrypt($secret, $salt, 1000);
```

`$secret` and `$salt` are inputs to PBKDF2-SHA3 (technically one is the key, the other is the salt, but you need to store them both somewhere, preferably in different places). `1000` is the number of PBKDF2 rounds.

### Encrypt / decrypt

[](#encrypt--decrypt)

After constructing an instance, use `encrypt3ncr` and `decrypt3ncr`:

```
$token = '08019215-B205-4416-B2FB-132962F9952F'; // your secret you want to encrypt
$encryptedSecretToken = $tokenCrypt->encrypt3ncr($token);
// $encryptedSecretToken === '3ncr.org/1#pHRufQld0SajqjHx+FmLMcORfNQi1d674ziOPpG52hqW5+0zfJD91hjXsBsvULVtB017mEghGy3Ohj+GgQY5MQ'

// ... some time later in another context ...

$decryptedSecretToken = $tokenCrypt->decrypt3ncr($encryptedSecretToken);
// $decryptedSecretToken === '08019215-B205-4416-B2FB-132962F9952F'
```

`decrypt3ncr` returns the input unchanged when it does not start with the `3ncr.org/1#` header, so it is safe to route every configuration value through it regardless of whether it was encrypted.

For JSON config files you can decrypt all 3ncr-encoded values in one pass:

```
$encConfig = json_decode(file_get_contents('config.json'), true);
$config = $tokenCrypt->decrypt3ncrArray($encConfig);
```

License
-------

[](#license)

MIT — see [LICENSE](LICENSE).

###  Health Score

55

—

FairBetter than 97% of packages

Maintenance92

Actively maintained with recent releases

Popularity28

Limited adoption so far

Community13

Small or concentrated contributor base

Maturity72

Established project with proven stability

 Bus Factor1

Top contributor holds 67.9% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~396 days

Recently: every ~495 days

Total

6

Last Release

72d ago

Major Versions

1.0.6 → 2.0.02026-04-23

PHP version history (2 changes)1.0.0PHP >=7.2.0

2.0.0PHP >=8.1

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/994900?v=4)[Andrian Budantsov](/maintainers/AndrianBdn)[@AndrianBdn](https://github.com/AndrianBdn)

---

Top Contributors

[![AndrianBdn](https://avatars.githubusercontent.com/u/994900?v=4)](https://github.com/AndrianBdn "AndrianBdn (38 commits)")[![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4)](https://github.com/dependabot[bot] "dependabot[bot] (12 commits)")[![peo-machine](https://avatars.githubusercontent.com/u/12561730?v=4)](https://github.com/peo-machine "peo-machine (5 commits)")[![pkotets](https://avatars.githubusercontent.com/u/99185488?v=4)](https://github.com/pkotets "pkotets (1 commits)")

###  Code Quality

TestsPHPUnit

Code StylePHP CS Fixer

### Embed Badge

![Health badge](/badges/3ncr-tokencrypt-php/health.svg)

```
[![Health](https://phpackages.com/badges/3ncr-tokencrypt-php/health.svg)](https://phpackages.com/packages/3ncr-tokencrypt-php)
```

###  Alternatives

[mews/purifier

Laravel 5/6/7/8/9/10 HtmlPurifier Package

2.0k18.7M143](/packages/mews-purifier)[paragonie/ecc

PHP Elliptic Curve Cryptography library

24820.0k37](/packages/paragonie-ecc)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)