---
title: "crypt.encrypt"
description: "Encrypts raw plaintext using AES-256-CBC and returns Base64 ciphertext plus Base64 IV."
---

```lua
crypt.encrypt(data: string, key: string, iv: string? = nil, mode: string? = "CBC"): (string, string)
```

---

## Aliases

None.

---

## Arguments

<ParamField body="data" type="string" required>
  The input bytes as a binary-safe Luau string.
</ParamField>

<ParamField body="key" type="string" required>
  A Base64-encoded key that decodes to exactly 32 bytes.
</ParamField>

<ParamField body="iv" type="string" default={"nil"}>
  Optional Base64 IV. Omit it to generate one; a supplied IV must decode to at least 16 bytes.
</ParamField>

<ParamField body="mode" type="string" default={"\"CBC\""}>
  The encryption mode; this implementation supports CBC only.
</ParamField>

---

## Returns

<ResponseField name="ciphertext" type="string">
  The Base64-encoded AES-256-CBC ciphertext.
</ResponseField>

<ResponseField name="iv" type="string">
  The Base64 IV to preserve for decryption.
</ResponseField>

Only CBC, case-insensitive. Key must decode to 32 bytes. Omitted IV generates 16 bytes; supplied IV must decode to at least 16 bytes (first 16 used). CBC does not authenticate ciphertext; define integrity separately when needed.

---

## Example

```lua
local key = crypt.generatekey()
local encrypted, iv = crypt.encrypt("hello", key)
print(crypt.decrypt(encrypted, key, iv))
```