PHPackages threadi/crypt-for-wordpress - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Security](/categories/security) 4. / 5. threadi/crypt-for-wordpress ActiveLibrary[Security](/categories/security) threadi/crypt-for-wordpress =========================== 2.0.1(1mo ago)2721[2 issues](https://github.com/threadi/crypt-for-wordpress/issues)1GPL-3.0-or-laterPHPCI passing Since Mar 14Pushed 2mo agoCompare [ Source](https://github.com/threadi/crypt-for-wordpress)[ Packagist](https://packagist.org/packages/threadi/crypt-for-wordpress)[ RSS](/packages/threadi-crypt-for-wordpress/feed)WikiDiscussions master Synced 1w ago READMEChangelog (10)Dependencies (28)Versions (53)Used By (1) Crypt for WordPress =================== [](#crypt-for-wordpress) This repository contains the source code for the Composer package “Crypt for WordPress”. It can be used in plugins or themes to encrypt strings. How it works ------------ [](#how-it-works) A hash key is generated for each plugin or theme, that is used for all encryption and decryption. This key is stored one of the supported places (like the file **wp-config.php**). As a result, it is not stored in the database where the encrypted data resides, keeping the key and the data separate. This makes it more difficult for attackers to decrypt the data, as they would need both to be successful. The **wp-config.php** file is primarily used for this purpose. If this file is not writable (that is the case with some hosting providers), a Must-Use plugin is generated and stored. Optionally, you can force the usage of a Must-Use plugin for each plugin or theme (see Settings below). ### Hint [](#hint) Data encryption is not a silver bullet for protecting data. Projects that involve sensitive data should be secured through additional measures in addition to encryption. These include, for example, security plugins. This Composer package is not the only solution for this, but it can help. Demo ---- [](#demo) [This demo plugin](https://github.com/threadi/crypt-for-wordpress-demo) demonstrates how the encryption could be used. Use cases --------- [](#use-cases) - You allow users of your plugin to enter API credentials and want to store them securely in the database. - You allow users to enter FTP credentials and want to store them securely in the database. - You want users to enter JSON authentication data and store it securely. - You collect personal data - for example, from job applicants or customers - on your website, and this data must be stored securely. Requirements ------------ [](#requirements) - *composer* to install this package. - WordPress-plugin or theme to embed them in your project. Installation ------------ [](#installation) 1. `composer require threadi/crypt-for-wordpress` 2. Add the following codes in your plugin or theme: ``` $crypt = new \CryptForWordPress\Crypt( __FILE__ ); ``` ### Parameters [](#parameters) #### set\_config() [](#set_config) Set your custom configuration for the supported methods as array. This is optional, all options are optional. Format: ``` array( 'force_method' => 'openssl', // openssl or sodium. 'force_place' => 'wpconfig', // one of the supported places. 'openssl' => array( 'hash_type' => 'hash_pbkdf2', // hash_pbkdf2 or hash. 'hash_algorithm' => 'sha256' // see hints below. 'force_mu_plugin => false, // true to force the usage of an MU-plugin to save the hashed key. ) 'sodium' => array( 'hash_type' => 'sodium_crypto_aead_xchacha20poly1305_ietf_keygen' // one of: sodium_crypto_aead_xchacha20poly1305_ietf_keygen, sodium_crypto_secretbox_keygen, sodium_crypto_auth_keygen, sodium_crypto_generichash_keygen, sodium_crypto_kdf_keygen, random_bytes ) ) ``` ##### Hint about usage of ciphers [](#hint-about-usage-of-ciphers) In March 2026 you should only use one of these ciphers: - aes-256-gcm - aes-256-cbc - chacha20-poly1305 ##### Hint about changes [](#hint-about-changes) If you change any of these settings, the changes will apply to newly encrypted strings. Strings that have already been encrypted will not be altered. Depending on the change, this could result in strings that were encrypted before the change no longer being decryptable. Usage ----- [](#usage) ### Encrypt [](#encrypt) To encrypt a plain string use: ``` $encrypted = $crypt->encrypt( 'My string to encrypt.' ); ``` ### Decrypt [](#decrypt) To decrypt an encrypted string use: ``` $decrypted = $crypt->decrypt( 'My encrypted string to decrypt.' ); ``` ### Errors [](#errors) Check and get errors: ``` if( $crypt->has_errors() ) { var_dump( $crypt->get_errors() ); } ``` This is an WP\_Error object, which will contain any error happened during the request. See also: [Error Handling](docs/ErrorHandling.md) Uninstall --------- [](#uninstall) Use these code to remove the settings during uninstallation of your theme or plugin: ``` $crypt = new \CryptForWordPress\Crypt( __FILE__ ); $crypt->uninstall(); ``` Places ------ [](#places) The key, used to encrypt and decrypt strings, are saved in one place. We support the following places: PlaceDefault OrderDescriptionCustomFileUse a custom file to store the key.Database3Save the key in the WordPress-own database - not recommendedEnvironmentVariableUse an $\_ENV variable in your hosting for the key.MuPlugin2Let us create an custom "must-use"-plugin to save the key.ServerVariableUse an $\_SERVER variable in your hosting for the key.WordPressSaltsUse a WordPress Salts as key.WpConfig1Let us save the key in your wp-config.phpHooks ----- [](#hooks) Several hooks are provided. These always have the slug of the plugin or theme that uses the package as a prefix, followed by the abbreviation "crypt" to distinguish the hook from other hooks. **Example:** Plugin: `crypt.for.wordpress-demo`Filter: `crypt-for-wordpress-crypt_errors` The list of hooks is available in the [Hooks](docs/hooks.md) documentation. Check for WordPress Coding Standards ------------------------------------ [](#check-for-wordpress-coding-standards) ### Initialize [](#initialize) `composer install` ### Run [](#run) `vendor/bin/phpcs .` ### Repair [](#repair) `vendor/bin/phpcbf .` Analyse with PHPStan -------------------- [](#analyse-with-phpstan) `vendor/bin/phpstan analyse` Check for WordPress VIP Coding Standards ---------------------------------------- [](#check-for-wordpress-vip-coding-standards) Hint: this check runs against the VIP-GO-platform which is not our target for this plugin. Many warnings can be ignored. ### Run [](#run-1) `vendor/bin/phpcs --extensions=php --ignore=*/vendor/*,*/tests/* --standard=WordPress-VIP-Go .` Generate documentation ---------------------- [](#generate-documentation) `vendor/bin/wp-documentor parse src --format=markdown --output=docs/hooks.md` ### Health Score 40 — FairBetter than 86% of packages Maintenance68 Regular maintenance activity Popularity22 Limited adoption so far Community10 Small or concentrated contributor base Maturity48 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~11 days Recently: every ~22 days Total 10 Last Release 43d ago Major Versions 1.2.1 → 2.0.02026-06-26 ### Community Maintainers ![](https://www.gravatar.com/avatar/e7a1a0cb36bcd1de4fc890549902fe36e51f89dd126fb83f0dba09a4d5ecdfb7?d=identicon)[threadi](/maintainers/threadi) --- Top Contributors [![threadi](https://avatars.githubusercontent.com/u/16623633?v=4)](https://github.com/threadi "threadi (59 commits)") ### Code Quality Static AnalysisPHPStan Type Coverage Yes ### Embed Badge ![Health badge](/badges/threadi-crypt-for-wordpress/health.svg) ``` [![Health](https://phpackages.com/badges/threadi-crypt-for-wordpress/health.svg)](https://phpackages.com/packages/threadi-crypt-for-wordpress) ``` ### Alternatives [paragonie/ecc PHP Elliptic Curve Cryptography library 25866.3k43](/packages/paragonie-ecc)[sansec/magento2-module-shield 15218.6k](/packages/sansec-magento2-module-shield)[dwgebler/encryption Encryption wrapper for PHP using libsodium — simple API for symmetric and asymmetric encryption, password hashing, digital signing, and message authentication. 317.5k](/packages/dwgebler-encryption) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)