[API reference](https://evolu.dev/docs/api-reference) › [@evolu/common](https://evolu.dev/docs/api-reference/common) › [local‑first/Auth](https://evolu.dev/docs/api-reference/common/local-first/Auth) › wrapDeviceSecret

```ts
function wrapDeviceSecret(
  deps: RandomBytesDep,
): (
  secret: Uint8Array<ArrayBufferLike> &
    Brand<"Entropy"> &
    Brand<"Length32"> &
    Brand<"DeviceSecret">,
  key: Uint8Array<ArrayBufferLike> & Brand<"Entropy"> & Brand<"Length32">,
) => Uint8Array<ArrayBufferLike> &
  Brand<"Length72"> &
  Brand<"WrappedDeviceSecret">;
```

Defined in: [packages/common/src/local-first/Auth.ts:205](https://github.com/evoluhq/evolu/blob/aa223771feea747ffb1b0f5f3271574455633e37/packages/common/src/local-first/Auth.ts#L205)

Wraps a [DeviceSecret](https://evolu.dev/docs/api-reference/common/local-first/Auth/variables/DeviceSecret) with a key from a [DeviceSecretKeyProvider](https://evolu.dev/docs/api-reference/common/local-first/Auth/interfaces/DeviceSecretKeyProvider).
A fresh random nonce makes every wrap of the same secret different.