crypto-javascript

library4.3.6jsnpmunverified

JavaScript library of cryptographic standards. Provides implementations of hash functions (MD5, SHA-1, SHA-256, SHA3, RIPEMD-160), HMAC, symmetric ciphers (AES, DES, TripleDES, RC4, Rabbit, RabbitLegacy, PBKDF2, EvpKDF) and encoders (Base64, Hex, Latin1, Utf8, Utf16). Ideal for client-side encryption where Node.js crypto module is unavailable. Version 4.3.6 is the latest stable release. It is a direct port of popular C++ crypto++ library algorithms to JavaScript, with no external dependencies. Not recommended for new projects due to security concerns (insecure default modes, lack of authenticated encryption). Use the Web Crypto API or Node.js crypto module instead.

security

github ↗package ↗homepage ↗

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

Default import from module; named import not available.

import AES from 'crypto-js/aes'

ESM default import works; require works but is CommonJS.

import SHA256 from 'crypto-js/sha256'

crypto-js uses deep imports for tree shaking; full library import works but not tree-shakeable.

import encHex from 'crypto-js/enc-hex'

Encrypt and decrypt a string using AES with a passphrase. Shows import of specific modules and conversion to/from strings.

import AES from 'crypto-js/aes'; import encUtf8 from 'crypto-js/enc-utf8'; import encBase64 from 'crypto-js/enc-base64'; const key = 'Secret Passphrase'; const plaintext = 'Hello World'; // Encrypt const ciphertext = AES.encrypt(plaintext, key).toString(); console.log('Ciphertext:', ciphertext); // Decrypt const bytes = AES.decrypt(ciphertext, key); const decrypted = bytes.toString(encUtf8); console.log('Decrypted:', decrypted);

Debug

Known footguns

deprecatedcrypto-js uses insecure defaults: ECB mode and no padding. This is vulnerable to pattern analysis.

gotchaWhen encrypting with a passphrase, crypto-js uses a default 256-bit key, but the salt is random and not stored. Decryption fails if passphrase is wrong but no error thrown.

breakingIn version 4.0.0, the package was rewritten as ECMAScript modules. Import paths changed.

Upgrade

Version history

Breaking-change detection hasn't run for this library yet.

Audit

Security & dependencies

CVE tracking and dependency tree are planned for a later release.

Agent activity

17 hits · last 30 days

gptbot

bytedance

ahrefsbot

bingbot

Resources

githubhttp://github.com/brix/crypto-js ↗

packagecrypto-javascript ↗

homepagehttp://github.com/brix/crypto-js ↗