Store flow
The API sanitizes and validates text, enforces a body limit, creates a random key and IV, encrypts with AES-256-GCM, and persists only ciphertext plus the authentication data.
04
Open-source encrypted text service
Open sourcetextWormhole.
Store encrypted text, keep the identifier and key, retrieve it when needed.
A compact Node.js and Express service that validates text, encrypts it with AES-256-GCM before persistence, and retrieves it through a human-readable identifier plus a 256-bit key.
01
The brief
Make the complex
feel obvious.
Create the smallest understandable store-and-retrieve flow for text while keeping persisted message content encrypted and protecting the API from basic abuse.
The service has to make two unusual credentials, a generated phrase and a long hexadecimal key, understandable to a user while validating input and never writing plaintext messages to storage.
AES256-GCM encryption
05word identifier
10requests per minute
02
What was built
A system,
not a skin.
The current project favors a lightweight interface and a small, inspectable Node.js codebase. The portfolio treatment turns its identifier, key, IV, ciphertext, and authentication tag into a visual system.
Memorable retrieval
A cryptographically selected five-word identifier is paired with a 64-character key so the stored message can be located and decrypted later.
Small abuse controls
Requests are rate limited per IP, identifiers and keys are pattern-validated, and authenticated decryption rejects incorrect keys or altered data.
03
Request flow
Plain text in.
Ciphertext stored.
POST /store
Validate text, enforce the size limit, and apply the per-IP request window.
KEY + IV
Generate a random 256-bit key and a 12-byte initialization vector.
AES-256-GCM
Encrypt on the server and produce ciphertext plus an authentication tag.
JSON STORAGE
Persist the identifier, timestamp, IV, tag, and ciphertext, never the plaintext.
GET /retrieve
Validate the identifier and key, authenticate the payload, then return decrypted text.
04
Design decisions
Every choice
has a job.
Authenticated encryption
AES-256-GCM protects confidentiality and detects a wrong key or modified ciphertext during retrieval.
Words over opaque IDs
Five randomly selected words make the lookup identifier easier to transfer while the separate key retains cryptographic strength.
Compact by design
Express, JSON storage, and a framework-free frontend keep the prototype direct and easy to inspect.
05
The outcome
Built for clarity.
Ready for the next step.
- A complete store-and-retrieve path with authenticated encryption before persistence.
- A human-readable identifier system backed by cryptographically secure random selection.
- An open codebase that makes the API and security decisions easy to study and extend.
Next case study 01 / 04
Ajdinović Gradnja.