Fernet Symmetric Key Encryption

Fernet is the "encrypt a message so only someone with the key can read it" tool, and FernetSimple is the node that gives it to you with one input box, a key, and a toggle. No salt handling, no mode-of-operation menus, no IVs to configure - Fernet bakes all of that in. If you need symmetric encryption inside a workflow and don't want to think about it, this is the node. It's the pack's most approachable modern-crypto node, and it stays approachable because the cryptography library's Fernet implementation does the heavy lifting.

What it does

You give it three things:

• text - the message, a multiline string (defaults to "Hello World!").
• key (BYTESLIKE) - a Fernet key, which is a URL-safe base64-encoded 32 bytes. It has to be exactly 32 bytes of key material, and the tooltip is blunt about it: "Has to be 32 bytes in size." The matching FernetKeygenSimple node in this pack generates one properly - use that instead of typing random characters, because a hand-typed "key" that isn't 32 bytes and correctly base64-encoded will just throw an error.
• mode - a BOOLEAN toggle. On is encrypt, off is decrypt. One node does both directions, which is convenient right up until you forget which way the toggle was pointing and encrypt your own ciphertext.

The output

• encrypted_txt (STRING) - the token. Encrypting produces a base64 token that includes a timestamp, the IV, the AES-128-CBC ciphertext, and an HMAC; decrypting reverses that. Because Fernet tokens embed a timestamp, they're also implicitly time-limited - older cryptography versions reject tokens with a default 60-second clock skew, so if you encrypt and decrypt across restarts with a stale clock, decryption can fail.

How it works under the hood

The node does text.encode("utf-8"), then Fernet(key).encrypt(...) or .decrypt(...) depending on the toggle. That's it - there's no password stretching, no salt, no room for a misconfiguration. The "key" is the secret, so the only security advice that matters is: keep the key secret and don't reuse it forever. It's symmetric crypto, so the same key both encrypts and decrypts - hand the key to the person you want to read it, not to anyone else.

Installing it

It ships in the ComfyUI ARG Toolkit:

cd ComfyUI/custom_nodes
git clone https://github.com/AzelusLightvale/ComfyUI-ARG-Toolkit

Restart ComfyUI, or search "ComfyUI ARG Toolkit" in ComfyUI Manager and let it pull cryptography (the Fernet implementation) plus the pack's other dependencies.

Where people get burned

• The key isn't a password. Fernet keys are specific: 32 bytes, base64-encoded, with a version byte prefix. Typing a passphrase into the key input fails. Generate with FernetKeygenSimple and treat the bytes as precious.
• Encrypting with one key, decrypting with another. Symmetric crypto is unforgiving - a single wrong byte in the key and decryption throws InvalidToken. Save the key bytes and reuse them.
• Mode toggle confusion. The same node does both jobs. When decryption starts failing, first check which way mode is pointing.

For a beginner who just wants "encode a secret, decode it later," FernetSimple is the least-surprising modern node in this pack. The trade-off is that it's a single key - there's no per-message password here, so whoever holds the key reads everything.