PHPackages                             jardissupport/secret - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. jardissupport/secret

ActiveLibrary[Security](/categories/security)

jardissupport/secret
====================

Secret resolution for encrypted configuration values using AES-256-GCM and Sodium with key provider abstraction

v1.0.5(1mo ago)033MITPHPPHP >=8.2CI passing

Since Jun 2Pushed 2mo agoCompare

[ Source](https://github.com/jardisSupport/secret)[ Packagist](https://packagist.org/packages/jardissupport/secret)[ Docs](https://jardis.io)[ RSS](/packages/jardissupport-secret/feed)WikiDiscussions main Synced 4w ago

READMEChangelog (6)Dependencies (12)Versions (9)Used By (0)

Jardis Secret
=============

[](#jardis-secret)

[![Build Status](https://github.com/jardisSupport/secret/actions/workflows/ci.yml/badge.svg)](https://github.com/jardisSupport/secret/actions/workflows/ci.yml/badge.svg)[![License: MIT](https://camo.githubusercontent.com/784362b26e4b3546254f1893e778ba64616e362bd6ac791991d2c9e880a3a64e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c6963656e73652d4d49542d677265656e2e737667)](LICENSE.md)[![PHP Version](https://camo.githubusercontent.com/a68b290dcc313d698dc138a1111aa83eee2f143605449d7e8b5416ea6f88558f/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d253345253344382e322d3737374242342e737667)](https://www.php.net/)[![PHPStan Level](https://camo.githubusercontent.com/c51bda247654363d3e30bc352674dd761a9557803a14af0226eb411d6dc0006b/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048505374616e2d4c6576656c253230382d627269676874677265656e2e737667)](phpstan.neon)[![PSR-12](https://camo.githubusercontent.com/34b10db0caa29bacd49bda5c437a8de95385f036f3230b31fa605326e18da22c/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f436f64652532305374796c652d5053522d2d31322d626c75652e737667)](phpcs.xml)[![Coverage](https://camo.githubusercontent.com/8a8debaaf2a8c8f3ec42ea8765f0d761b91f9b71333f8355f437132278e86eec/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f436f7665726167652d39352e31342532352d627269676874677265656e2e737667)](https://github.com/jardisSupport/secret)

> Part of **[Jardis](https://jardis.io)** — the Domain-Driven Design platform for PHP. You model your domain; Jardis generates the production-ready hexagonal code (DTOs, Command/Query handlers, repositories, persistence). This package is part of the open-source foundation that generated code runs on.

Encrypted .env secrets for PHP — encrypt configuration values with AES-256-GCM or Sodium, store them safely in `.env` files, and decrypt transparently at load time. Plugs into the DotEnv cast chain — no manual decryption calls needed.

---

Features
--------

[](#features)

- **AES-256-GCM Encryption** — authenticated encryption via OpenSSL; `AesSecretResolver` handles encrypt and decrypt
- **Sodium XSalsa20-Poly1305** — libsodium-based encryption via `SodiumSecretResolver` with explicit `sodium:` prefix
- **DotEnv Integration** — `SecretHandler` plugs directly into `DotEnv::addHandler()` as a prepended cast handler
- **Resolver Chain** — `SecretResolverChain` delegates to the first resolver whose prefix matches the encrypted value
- **Key Providers** — `FileKeyProvider` reads a 32-byte key from a file; `EnvKeyProvider` reads from an environment variable; both auto-detect base64 encoding
- **Makefile Tooling** — `make generate-key-file`, `make encrypt`, and `make encrypt-sodium` for setup and secret rotation
- **Typed Exceptions** — `InvalidKeyException`, `DecryptionFailedException`, and `EncryptionFailedException` for precise error handling

---

Installation
------------

[](#installation)

```
composer require jardissupport/secret
```

Quick Start
-----------

[](#quick-start)

### 1. Generate a key and encrypt a value

[](#1-generate-a-key-and-encrypt-a-value)

```
make generate-key-file                      # Creates support/secret.key
make encrypt VALUE="my-database-password"   # Outputs: secret(base64...)
```

### 2. Store the encrypted value in `.env`

[](#2-store-the-encrypted-value-in-env)

```
DB_PASSWORD=secret(base64encodedEncryptedValue)
```

### 3. Integrate with DotEnv

[](#3-integrate-with-dotenv)

```
use JardisSupport\DotEnv\DotEnv;
use JardisSupport\Secret\Handler\SecretHandler;
use JardisSupport\Secret\KeyProvider\FileKeyProvider;

$dotEnv = new DotEnv();
$dotEnv->addHandler(
    new SecretHandler(new FileKeyProvider('support/secret.key')),
    prepend: true,
);

$config = $dotEnv->loadPrivate('/path/to/app');
// $config['DB_PASSWORD'] → decrypted plaintext, no secret() wrapper
```

Advanced Usage
--------------

[](#advanced-usage)

```
use JardisSupport\Secret\Handler\SecretHandler;
use JardisSupport\Secret\Handler\SecretResolverChain;
use JardisSupport\Secret\KeyProvider\EnvKeyProvider;
use JardisSupport\Secret\KeyProvider\FileKeyProvider;
use JardisSupport\Secret\Resolver\AesSecretResolver;
use JardisSupport\Secret\Resolver\SodiumSecretResolver;
use JardisSupport\DotEnv\DotEnv;

// Key from environment variable instead of a file
// EnvKeyProvider auto-detects base64-encoded keys
$keyProvider = new EnvKeyProvider('APP_SECRET_KEY');

// Build a custom resolver chain with explicit ordering
// Sodium resolver matches 'sodium:...' prefix; AES is the catch-all fallback
$chain = (new SecretResolverChain())
    ->addResolver(new SodiumSecretResolver($keyProvider))
    ->addResolver(new AesSecretResolver($keyProvider));

// Encrypt a Sodium value (e.g. in a setup script)
// make encrypt-sodium VALUE="my-api-key"  → secret(sodium:base64...)

// .env with mixed encryption algorithms:
//   DB_PASSWORD=secret(base64AesEncryptedValue)
//   API_KEY=secret(sodium:base64SodiumEncryptedValue)
//   PLAIN=no-encryption-needed

$dotEnv = new DotEnv();
$dotEnv->addHandler(new SecretHandler($keyProvider), prepend: true);

// SecretHandler automatically wires both AES and Sodium resolvers;
// use a manual chain only when you need fine-grained resolver control
$config = $dotEnv->loadPrivate('/path/to/app');

// DB_PASSWORD → AES-decrypted string
// API_KEY     → Sodium-decrypted string
// PLAIN       → 'no-encryption-needed' (passed through unchanged)
```

Documentation
-------------

[](#documentation)

Full documentation, guides, and API reference:

**[docs.jardis.io/en/support/secret](https://docs.jardis.io/en/support/secret)**

License
-------

[](#license)

This package is licensed under the [MIT License](LICENSE.md).

---

**[Jardis](https://jardis.io)** · [Documentation](https://docs.jardis.io) · [Headgent](https://headgent.com)

AI-Assisted Development
-----------------------

[](#ai-assisted-development)

This package ships with a skill for Claude Code, Cursor, Continue, and Aider. Install it in your consuming project:

```
composer require --dev jardis/dev-skills
```

More details:

###  Health Score

41

—

FairBetter than 87% of packages

Maintenance89

Actively maintained with recent releases

Popularity10

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity51

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~6 days

Total

6

Last Release

35d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/e07a1b668e9e01ee6d1b85de7b3be1c2513f68aae9494b2011d1592104d5daa0?d=identicon)[jardis](/maintainers/jardis)

---

Top Contributors

[![Headgent](https://avatars.githubusercontent.com/u/245725954?v=4)](https://github.com/Headgent "Headgent (1 commits)")

---

Tags

phpencryptionaesenvironmentdotenvDomain Driven Designsecretsodiumaes-256-gcmHeadgentjardisjardisSupport

###  Code Quality

TestsPHPUnit

Static AnalysisPHPStan

Code StylePHP\_CodeSniffer

Type Coverage Yes

### Embed Badge

![Health badge](/badges/jardissupport-secret/health.svg)

```
[![Health](https://phpackages.com/badges/jardissupport-secret/health.svg)](https://phpackages.com/packages/jardissupport-secret)
```

###  Alternatives

[johnathanmiller/secure-env-php

Encrypt environment files for production use.

5956.4k2](/packages/johnathanmiller-secure-env-php)[poly-crypto/poly-crypto

High-level cryptographic functions that are interoperable between NodeJS and PHP 7.1+

128.1k1](/packages/poly-crypto-poly-crypto)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)