saltpack.org

What It Is

saltpack is a modern encrypted message format designed for encoding, transmitting, or storing encrypted and signed data. It is not a full collaboration or key management product, but rather a low-level format and implementation for developers, with an emphasis on being “simple, easy to implement, and easy to integrate.” The project has been developed continuously by Keybase and collaborators since 2017, and has been used in Keybase’s production applications.

Core Capabilities

In terms of functionality, saltpack covers encryption, signcryption, signing, and armoring. Its binary message format is based on MessagePack. Messages are split into chunks of around 1MB, with NaCl-related cryptographic operations performed on those chunks. The documentation particularly highlights improvements over traditional message formats: it only outputs authenticated data, uses deniable authentication where possible, prevents chunk reordering or mixing with other transports, can hide sender and recipient public keys, and can detect message truncation.

Languages, API, and Ecosystem

The scraped text explicitly mentions that Python and Go implementation source code can be found on GitHub, but it does not show specific APIs, installation methods, package manager names, or version compatibility policies. The site includes documentation entries such as Spec, FAQ, signing, encryption, signcryption, and armoring, making it better suited to experienced developers who can read the specification and integrate it themselves. Feedback is handled via GitHub issues, and the ecosystem is closely tied to Keybase.

Pricing and Open Source

No commercial pricing appears in the text. Since GitHub source code is provided, at least the Python and Go implementations are available as public source code. However, the scraped content does not show details about the license, contribution governance, or security audits. Since it is essentially a format and library, typical SaaS-style self-hosting options do not apply.

Pros, Cons, and Who It’s For

Its strengths are a clearly defined scope, reuse of NaCl where possible, and fewer custom cryptographic design decisions. Its text armoring is more suitable for copy and paste than PGP, helping avoid issues where hyphens, line breaks, and similar characters are broken by websites or applications. The downsides are that the documentation is more specification-oriented, with few visible quick-start examples in the scraped content; only Python and Go support are explicitly mentioned, so the ecosystem breadth is limited. It is suitable for development teams building secure communication, signature wrapping, or encrypted file/message transfer, but not for users looking for an out-of-the-box key management platform.

Access from China

The scraped text does not provide information about access from mainland China, mirrors, or payment. GitHub access may vary depending on network conditions. If stable usage is not possible, alternatives such as PGP/GPG, age, or solutions built directly on libsodium/NaCl may be worth evaluating.