// the take
Tink is Google's multi-language crypto library (Java, C++, Go, Python, Obj-C, with alpha JS/TS) that wraps AEAD, MAC, hybrid encryption, digital signatures, and JWT behind primitive-based APIs designed to make the common misuse cases hard to hit. It's for backend and mobile developers who need real crypto (key rotation, envelope encryption, KMS integration) without wanting to reason about nonce reuse or padding oracles themselves.
The API design actively resists footguns — you get an AEAD or Mac primitive object, not raw key bytes, so there's no way to reuse a nonce or pick an insecure mode by accident. Test coverage is unusually deep: every key type (e.g. AesGcmKey, AesEaxKey) ships with its own manager, parameters, proto serialization, and Wycheproof-informed test vectors. KMS envelope encryption (kms_envelope_aead) is built in rather than bolted on, which matters if you're doing per-tenant key management. Consistent primitive model across five+ languages means a Java-trained mental model mostly transfers to the Go or C++ bindings.
This specific repo's README states it is no longer active — Tink was split into multiple repos under github.com/tink-crypto and this one is read-only, which is confusing for anyone landing here first and not obvious from the repo name alone. Last push was April 2024, consistent with it being an archived shell rather than where development happens now. JS/TS support is explicitly alpha with an open issue tracking its removal, so don't build on it. The C++ build is Bazel-first (CMake is secondary), which is friction if your stack isn't already Bazel-based.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →