Boundary-Aware Serialization for Go. Declare Once, Enforce Everywhere.
Transform data differently as it crosses system boundaries — encrypt for storage, mask for APIs, hash on receive. Security requirements live in struct tags.
Get Startedimport "github.com/zoobz-io/cereal"
type User struct {
ID string `json:"id"`
Email string `json:"email" store.encrypt:"aes" load.decrypt:"aes" send.mask:"email"`
Password string `json:"password" receive.hash:"argon2"`
SSN string `json:"ssn" send.mask:"ssn"`
Token string `json:"token" send.redact:"[REDACTED]"`
}
func (u User) Clone() User { return u }
proc, _ := cereal.NewProcessor[User]()
enc, _ := cereal.AES([]byte("32-byte-key-for-aes-256-encrypt!"))
proc.SetEncryptor(cereal.EncryptAES, enc)
received, _ := proc.Receive(ctx, user) // Password hashed
stored, _ := proc.Store(ctx, received) // Email encrypted
loaded, _ := proc.Load(ctx, stored) // Email decrypted
sent, _ := proc.Send(ctx, loaded) // Email masked, SSN masked, Token redacted
// sent.Email = "a***@example.com"
// sent.SSN = "***-**-6789"
// sent.Token = "[REDACTED]"Why Cereal?
Different boundaries demand different transforms. Cereal handles all four.
Four Boundaries
Receive, Load, Store, Send — each edge applies its own transforms. Hash on ingest, encrypt at rest, mask on output.
Declarative Struct Tags
Security requirements live next to the fields they protect. One place to audit, one place to change.
Built-in Cryptography
AES-GCM, RSA-OAEP, envelope encryption, Argon2, bcrypt, SHA-256, SHA-512 — all wired through struct tags.
Format-Preserving Masking
Eight content-aware maskers: email, SSN, phone, card, IP, UUID, IBAN, name. Masked data stays debuggable.
Non-Destructive
Original values never mutated. Every operation clones before transforming, guaranteeing immutability.
Provider-Agnostic Codecs
Same types and tags work with JSON, YAML, XML, MessagePack, or BSON. Swap wire formats without touching transforms.
Capabilities
Encryption, hashing, masking, and redaction — applied automatically at the right system boundary.
| Feature | Description | Link |
|---|---|---|
| Encryption | AES-GCM symmetric, RSA-OAEP asymmetric, and envelope encryption for data at rest. | Encryption |
| Hashing | One-way hashing with Argon2, bcrypt, SHA-256, and SHA-512 on the receive boundary. | Encryption |
| Masking | Eight format-preserving maskers for PII in API responses. Content-aware partial masking. | Masking |
| Redaction | Full value replacement for secrets on the send boundary. Custom replacement strings. | Masking |
| Key Rotation | Four production-ready patterns for zero-downtime key updates: versioned, envelope, KMS, and Decryptable. | Key Rotation |
| Escape Hatches | Override interfaces bypass reflection on hot paths. Code generation keeps implementations in sync with tags. | Escape Hatches |
Articles
Browse the full cereal documentation.