1979 stars · Apache-2.0 (named in the About sidebar, with no added conditions) · 0.15.7 (2026-04-24), shown on /releases/latest as '24 Apr' with no year and settled by ungh's pushedAt of 2026-04-24T14:01:56Z matching the release timestamp to the minute · Track this in Scout
Four ready-made encryption jobs with the cipher, key length, curve and hash already chosen, in fifteen languages.
Radar check
What we found when we opened it. Every bar is one fact, with its date.
Last code pushed 24 Apr 2026, 6 months before this check.
Latest release 0.15.7 on 24 Apr 2026.
Public since May 2015, a little over 11 years.
1,979 stars and 159 forks.
0 commits and 1 new issues in the last 90 days.
34 contributors. No pull requests merged in 90 days; changes go in directly.
No security policy file says how to report a problem. No published security advisories.
How the bars are scored
- Alive. Days since the last code push: a week or less 100, a month 90, three months 70, six months 50, a year 30, eighteen months 15, older 0.
- Releases. Age of the latest GitHub release, on a similar scale; no bar when the project publishes no releases.
- Maturity. Age of the project: eight years 100, five 90, three 70, two 55, one 40, six months 25, younger 10.
- Adoption. Stars on a log scale: 100,000 stars is 100, 10,000 is 80, 1,000 is 60, 100 is 40.
- Activity. Commits in the last 90 days: 300 or more 100, 100 85, 30 65, 10 45, any 25.
- Community. People who have contributed: 100 or more 100, 30 80, 10 60, 5 40, 2 25, one 10.
- Security. A published security policy 80, none 40; published advisories are listed, not scored.
Checked by Repo Radar on 25 Oct 2026 from the repository on GitHub. Covered in Edition 61.
▶Repo detailsthe review · specs · pros & cons · install
What it does
It offers four cryptosystems rather than ciphers. Secure Cell encrypts something you are storing, using AES-256. Secure Message encrypts and signs something you are sending to a known recipient. Secure Session sets up a private two-way conversation with keys that change, so a stolen key cannot decrypt old traffic. Secure Comparator checks whether two parties hold the same secret without either revealing it. Underneath it uses OpenSSL, LibreSSL or BoringSSL, and above it there are wrappers for fifteen languages including Python, Go, Rust, Java, Kotlin, Swift, Ruby, PHP, Node and WebAssembly. The project claims this covers about 90% of ordinary data-protection needs. What it deliberately does not offer is any way to choose: there is no raw interface, and the cipher, the key length, the elliptic curve and the hash cannot be changed without building a custom version from source. It also has no post-quantum option and is not meant for very small hardware.
Why it matters
Who it suits. Anyone who has to encrypt something and does not want to become a cryptographer first. It fits a team writing the same feature in two languages, because the code reads almost the same in both. Skip it if a specific cipher or curve is required by a standard or a customer, because that is exactly what this library refuses to expose.
Verdict. Worth an hour, and the refusal to give you knobs is the feature rather than a limitation. The licence is plain Apache-2.0 with nothing bolted on, which is unusually clean for software in this field, and the code was last pushed on 24 April 2026 — six months ago, which is comfortable for a library whose whole point is not changing. Two practical warnings. The install is two steps, not one: a native library has to be added from the company's own package repository before the Python, Go or Node wrapper will work, which means adding a third-party signing key to the machine. And the documented platform list has fallen behind — it stops at macOS 11, iOS 15 and Android 12, and newer versions are simply outside what the documentation claims. For a library that does similar work with far more users and no vendor repository to add, jedisct1/libsodium is the usual answer, though it has no equivalent of the session or secret-comparison jobs.
- Four jobs with the choices already made, which removes the most common way to get this wrong.
- Fifteen languages with almost the same code, so two services can agree by construction.
- Plain Apache-2.0, with no added conditions and no paid tier held back.
- Nothing is adjustable: a required cipher or curve means building from source.
- Two-step install, including adding a third-party package repository to the machine.
- The documented platform list stops at older operating systems than most people now run.
- jedisct1/libsodium
ISC, 14.0k stars; the same idea of safe defaults instead of raw parts, as a C library with community bindings rather than one vendor's matched set, and with no session or secret-comparison equivalent.
Track this in Scout - tink-crypto/tink
Apache-2.0, 13.5k stars; a library built around the same principle of being hard to misuse. This repository was archived by its owners on 17 April 2024 and is read-only; the work continues in separate per-language repositories.
Track this in Scout
wget -qO - https://pkgs-ce.cossacklabs.com/gpg | sudo apt-key add - sudo apt install apt-transport-https echo "deb https://pkgs-ce.cossacklabs.com/stable/debian bookworm main" | sudo tee /etc/apt/sources.list.d/cossacklabs.list sudo apt update sudo apt install libthemis-dev
