Visualizer · runs in your browser
Four interactive walkthroughs of what the envelope actually does — then a token-gated panel that reads your own deployed store. The explainers use fixed sample data and run entirely client-side; the live panel calls the same-origin store and only ever reads non-secret data.
Explainer · encrypt / decrypt
A value is sealed under the tenant's DEK with a data-AAD, then the DEK is wrapped under the environment's KEK. Step through it — the console shows the exact call and encryption context.
The data-AAD { tenant, column, dek_ver } and the wrap-AAD { tenant, "dek-wrap", kek_kv } are derived from the row, never passed by hand.
Explainer · placement integrity
Copy one tenant's sealed blob into another tenant's row. On read, the store rebuilds the data-AAD from the destination row — a different tenant — so the GCM tag no longer verifies.
{ tenant: acme, column: STRIPE_KEY, dek_ver: 1 }{ tenant: globex, column: STRIPE_KEY, dek_ver: 1 }Bound field tenant differs → GCM additionalData differs → tag check fails.
This is placement integrity, not access control: an over-scoped token could still read globex legitimately. Isolation between tenants rests on token scoping.
Explainer · freshness anchor
The authoritative { version, ciphertext_hash } lives in a Durable Object outside D1. A D1-write attacker can forge the version, but not the anchored hash — so a reverted blob fails the read check.
The anchor commits to a hash of the current ciphertext, not a version the attacker also controls. A fully-compromised account that writes both D1 and the DO still defeats it — the assumed-control boundary — with the immutable audit mirror as the backstop.
Explainer · crypto-shred
Deleting a tenant's wrapped DEK makes all of its ciphertext undecryptable via the normal path at once — no row sweep. But real erasure completes later, and the store reports that true time, never "O(1), done."
dek_ver 1 · wrapped · status activeheldSTRIPE_KEYreadableOAUTH_REFRESHreadableWEBHOOK_SIGNINGreadableErasure completes at max(
) — not the moment you dropped the key.
Crypto-shred is the GDPR-erase primitive. It is irreversible only after those windows close — keep it behind an explicit soft-delete grace window.
Live store · token-gated
This runs against the store on this origin. It lists secret names and versions and reads the audit log with its hash-chain status — never a secret value. Your token is held in memory for this tab only and is never stored or logged.
Results appear here.
Fill the form and choose List secrets or Load audit.
Want the exact byte layout, golden vectors, and the error taxonomy?