Product
Introducing Java Support in Socket
We're excited to announce that Socket now supports the Java programming language.
The crypto-js npm package is a library of cryptographic algorithms implemented in JavaScript. It's commonly used for secure encryption and decryption of data, hashing, and generating secure random bytes. It's suitable for both server-side and client-side applications in JavaScript.
Encryption and Decryption
This feature allows you to encrypt and decrypt messages using various algorithms like AES, DES, Triple DES, Rabbit, and RC4. The code sample demonstrates how to encrypt and decrypt a message using AES.
{"encrypt": "CryptoJS.AES.encrypt('my message', 'secret key').toString()", "decrypt": "CryptoJS.AES.decrypt(encryptedMessage, 'secret key').toString(CryptoJS.enc.Utf8)"}
Hashing
Crypto-js can be used to hash data using algorithms like SHA-256, SHA-512, MD5, and more. The code sample shows how to hash a message using SHA-256 and SHA-512.
{"SHA256": "CryptoJS.SHA256('message').toString()", "SHA512": "CryptoJS.SHA512('message').toString()"}
HMAC (Hash-based Message Authentication Code)
This feature provides a way to verify both the data integrity and the authenticity of a message with a secret key. The code sample demonstrates generating an HMAC with the SHA-256 algorithm.
{"HMAC": "CryptoJS.HmacSHA256('message', 'secret').toString()"}
Progressive Ciphering
For large amounts of data, progressive ciphering allows you to encrypt or decrypt data in chunks rather than all at once. The code sample demonstrates how to encrypt data progressively.
{"progressiveCiphering": "var aesEncryptor = CryptoJS.algo.AES.createEncryptor('secret key', { iv: CryptoJS.enc.Hex.parse('0000000000000000') }); var ciphertextPart1 = aesEncryptor.process('part1 '); var ciphertextPart2 = aesEncryptor.process('part2 '); var ciphertextPart3 = aesEncryptor.process('part3 '); var ciphertextPart4 = aesEncryptor.finalize(); var encryptedMessage = ciphertextPart1.concat(ciphertextPart2).concat(ciphertextPart3).concat(ciphertextPart4).toString();"}
Secure Random Bytes Generation
Crypto-js can generate secure random bytes, which are useful for creating salts, keys, and other cryptographic elements. The code sample shows how to generate a random 16-byte string.
{"randomBytes": "CryptoJS.lib.WordArray.random(16).toString()"}
bcryptjs is a pure JavaScript implementation of the bcrypt password hashing function. It is useful for securely storing passwords. Unlike crypto-js, which offers a variety of cryptographic operations, bcryptjs focuses specifically on password hashing and is often used for this purpose in web applications.
node-forge is a native JavaScript implementation of various networking and cryptography tools including TLS, SSH, and various cryptographic algorithms. It is similar to crypto-js but offers additional features like TLS and SSH protocol support, making it suitable for more complex cryptographic tasks.
libsodium-wrappers provides a high-level API for libsodium, a modern and easy-to-use crypto library. It offers similar functionalities to crypto-js but focuses on high-performance operations and is based on the NaCl library, which is designed to be fast and secure.
JavaScript library of crypto standards.
Active development of CryptoJS has been discontinued. This library is no longer maintained.
Nowadays, NodeJS and modern browsers have a native Crypto
module. The latest version of CryptoJS already uses the native Crypto module for random number generation, since Math.random()
is not crypto-safe. Further development of CryptoJS would result in it only being a wrapper of native Crypto. Therefore, development and maintenance has been discontinued, it is time to go for the native crypto
module.
Requirements:
npm install crypto-js
ES6 import for typical API call signing use case:
import sha256 from 'crypto-js/sha256';
import hmacSHA512 from 'crypto-js/hmac-sha512';
import Base64 from 'crypto-js/enc-base64';
const message, nonce, path, privateKey; // ...
const hashDigest = sha256(nonce + message);
const hmacDigest = Base64.stringify(hmacSHA512(path + hashDigest, privateKey));
Modular include:
var AES = require("crypto-js/aes");
var SHA256 = require("crypto-js/sha256");
...
console.log(SHA256("Message"));
Including all libraries, for access to extra methods:
var CryptoJS = require("crypto-js");
console.log(CryptoJS.HmacSHA1("Message", "Key"));
Requirements:
bower install crypto-js
Modular include:
require.config({
packages: [
{
name: 'crypto-js',
location: 'path-to/bower_components/crypto-js',
main: 'index'
}
]
});
require(["crypto-js/aes", "crypto-js/sha256"], function (AES, SHA256) {
console.log(SHA256("Message"));
});
Including all libraries, for access to extra methods:
// Above-mentioned will work or use this simple form
require.config({
paths: {
'crypto-js': 'path-to/bower_components/crypto-js/crypto-js'
}
});
require(["crypto-js"], function (CryptoJS) {
console.log(CryptoJS.HmacSHA1("Message", "Key"));
});
<script type="text/javascript" src="path-to/bower_components/crypto-js/crypto-js.js"></script>
<script type="text/javascript">
var encrypted = CryptoJS.AES(...);
var encrypted = CryptoJS.SHA256(...);
</script>
See: https://cryptojs.gitbook.io/docs/
var CryptoJS = require("crypto-js");
// Encrypt
var ciphertext = CryptoJS.AES.encrypt('my message', 'secret key 123').toString();
// Decrypt
var bytes = CryptoJS.AES.decrypt(ciphertext, 'secret key 123');
var originalText = bytes.toString(CryptoJS.enc.Utf8);
console.log(originalText); // 'my message'
var CryptoJS = require("crypto-js");
var data = [{id: 1}, {id: 2}]
// Encrypt
var ciphertext = CryptoJS.AES.encrypt(JSON.stringify(data), 'secret key 123').toString();
// Decrypt
var bytes = CryptoJS.AES.decrypt(ciphertext, 'secret key 123');
var decryptedData = JSON.parse(bytes.toString(CryptoJS.enc.Utf8));
console.log(decryptedData); // [{id: 1}, {id: 2}]
crypto-js/core
crypto-js/x64-core
crypto-js/lib-typedarrays
crypto-js/md5
crypto-js/sha1
crypto-js/sha256
crypto-js/sha224
crypto-js/sha512
crypto-js/sha384
crypto-js/sha3
crypto-js/ripemd160
crypto-js/hmac-md5
crypto-js/hmac-sha1
crypto-js/hmac-sha256
crypto-js/hmac-sha224
crypto-js/hmac-sha512
crypto-js/hmac-sha384
crypto-js/hmac-sha3
crypto-js/hmac-ripemd160
crypto-js/pbkdf2
crypto-js/aes
crypto-js/tripledes
crypto-js/rc4
crypto-js/rabbit
crypto-js/rabbit-legacy
crypto-js/evpkdf
crypto-js/format-openssl
crypto-js/format-hex
crypto-js/enc-latin1
crypto-js/enc-utf8
crypto-js/enc-hex
crypto-js/enc-utf16
crypto-js/enc-base64
crypto-js/mode-cfb
crypto-js/mode-ctr
crypto-js/mode-ctr-gladman
crypto-js/mode-ofb
crypto-js/mode-ecb
crypto-js/pad-pkcs7
crypto-js/pad-ansix923
crypto-js/pad-iso10126
crypto-js/pad-iso97971
crypto-js/pad-zeropadding
crypto-js/pad-nopadding
Change default hash algorithm and iteration's for PBKDF2 to prevent weak security by using the default configuration.
Custom KDF Hasher
Blowfish support
Fix module order in bundled release.
Include the browser field in the released package.json.
Added url safe variant of base64 encoding. 357
Avoid webpack to add crypto-browser package. 364
This is an update including breaking changes for some environments.
In this version Math.random()
has been replaced by the random methods of the native crypto module.
For this reason CryptoJS might not run in some JavaScript environments without native crypto module. Such as IE 10 or before or React Native.
Rollback, 3.3.0
is the same as 3.1.9-1
.
The move of using native secure crypto module will be shifted to a new 4.x.x
version. As it is a breaking change the impact is too big for a minor release.
The usage of the native crypto module has been fixed. The import and access of the native crypto module has been improved.
In this version Math.random()
has been replaced by the random methods of the native crypto module.
For this reason CryptoJS might does not run in some JavaScript environments without native crypto module. Such as IE 10 or before.
If it's absolute required to run CryptoJS in such an environment, stay with 3.1.x
version. Encrypting and decrypting stays compatible. But keep in mind 3.1.x
versions still use Math.random()
which is cryptographically not secure, as it's not random enough.
This version came along with CRITICAL
BUG
.
DO NOT USE THIS VERSION! Please, go for a newer version!
The 3.1.x
are based on the original CryptoJS, wrapped in CommonJS modules.
FAQs
JavaScript library of crypto standards.
The npm package crypto-js receives a total of 5,751,052 weekly downloads. As such, crypto-js popularity was classified as popular.
We found that crypto-js demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Product
We're excited to announce that Socket now supports the Java programming language.
Security News
Socket detected a malicious Python package impersonating a popular browser cookie library to steal passwords, screenshots, webcam images, and Discord tokens.
Security News
Deno 2.0 is now available with enhanced package management, full Node.js and npm compatibility, improved performance, and support for major JavaScript frameworks.