Function encrypt 

pub fn encrypt(
    plaintext: &str,
    password: &str,
    rng: &mut (impl RngCore + CryptoRng),
) -> EncryptedPayload

Encrypt plaintext with password, using rng to generate a fresh salt and nonce (§2.1 — pure w.r.t. rng: the rng is the only source of nondeterminism).

Returns an EncryptedPayload carrying the ciphertext, salt, and nonce. Two calls with the same plaintext and password yield different payloads (different salt and nonce), so GCM nonce reuse is impossible.