browserify-sign is a JavaScript library that provides browser-compatible implementations of Node.js's `crypto` module public key functions, specifically `createSign` and `createVerify`. This allows developers to use cryptographic signing and verification operations, typically involving RSA or DSA algorithms, directly in web browsers by bundling their code with Browserify. The current stable version is 4.2.5, last published approximately seven months ago (as of April 2026). The project maintains a sustainable release cadence with at least one new version released annually, primarily focusing on maintenance and security updates rather than active feature development. Its key differentiator is enabling Node.js-style crypto APIs in browser environments, making it crucial for projects requiring consistent cryptographic behavior across server and client-side JavaScript when using the Browserify bundling approach.
npm install browserify-signVerified import paths — ran on the pinned version, not inferred.
Demonstrates how to use `browserify-sign` to sign data with a private key and verify it with a public key, mirroring Node.js crypto API. Key generation is shown using Node's native crypto, but in a browser, keys would be pre-loaded.
Avoid direct `require` calls to internal sub-paths like `/algos`. Instead, pass the algorithm string directly to the `Sign` or `Verify` constructor, e.g., `new Sign('SHA256')`.Immediately upgrade to `browserify-sign` version 4.2.2 or higher to patch the DSA signature forgery vulnerability. Always keep cryptographic libraries updated.
Ensure your project is set up to use Browserify for bundling browser-side code. If you require Node.js `crypto` in Node.js, use the built-in module. For modern browser-native crypto, consider Web Crypto API or modern bundlers with appropriate shims.
Ensure `browserify` is correctly configured to bundle your application and replace Node.js `crypto` with `browserify-sign` (often handled automatically by `crypto-browserify` which depends on `browserify-sign`). Run `browserify main.js -o bundle.js`.
Verify the algorithm string exactly matches one supported by the underlying crypto implementation (case-sensitive where relevant). Ensure private and public keys are correctly formatted PEM strings. Check the `CHANGELOG.md` or source for supported algorithms if issues persist.