tink
Tink is a multi-language, cross-platform, open source library that provides cryptographic APIs that are secure, easy to use correctly, and hard(er) to misuse.
A cryptography library from Google that makes encryption, signing, and key management easy to do safely across Java, Android, Go, Python, and C++, with an API designed to prevent common security mistakes. Note: this repo is now archived, use github.com/tink-crypto for active development.
Tink is a cryptography library created by engineers and cryptographers at Google, designed to make encryption and related security operations easier for developers to use correctly. Cryptography code is notoriously easy to implement incorrectly in ways that create security vulnerabilities, even for experienced programmers. Tink addresses this by providing a simplified, opinionated API that guides you toward safe choices and makes dangerous options harder to reach by accident. It was built from Google's internal experience identifying and fixing cryptographic mistakes across hundreds of products.
The library supports Java, Android, C++, Go, Python, and Objective-C, with all of those except a JavaScript version described as production-ready. It covers common cryptographic tasks such as encrypting data, signing and verifying data, generating and managing encryption keys, and streaming encryption for large amounts of data. The library also includes a command-line tool called Tinkey for managing encryption keys.
An important note about this repository: it is no longer active. The Tink team split the project into multiple separate repositories hosted at github.com/tink-crypto, and this original repository is now read-only and will not receive future updates. If you want to use Tink, you should go to the new repositories at that organization rather than using this one.
The last version released here was 1.7.0 in August 2022. Community members have also created ports to languages not officially supported, such as Clojure, though those ports are not maintained by the Google team and carry no official support guarantee.
Where it fits
- Encrypt sensitive data in your app using a safe, opinionated API that steers you away from cryptographic mistakes that create vulnerabilities.
- Sign and verify data to confirm it has not been tampered with, without writing low-level cryptography code yourself.
- Manage, store, and rotate encryption keys using the Tinkey command-line tool.
- Stream-encrypt large files without loading the entire file into memory.