The crypto-js npm package is a library of cryptographic algorithms implemented in JavaScript. It's commonly used for secure encryption and decryption of data, hashing, and generating secure random bytes. It's suitable for both server-side and client-side applications in JavaScript.
Encryption and Decryption
This feature allows you to encrypt and decrypt messages using various algorithms like AES, DES, Triple DES, Rabbit, and RC4. The code sample demonstrates how to encrypt and decrypt a message using AES.
{"encrypt": "CryptoJS.AES.encrypt('my message', 'secret key').toString()", "decrypt": "CryptoJS.AES.decrypt(encryptedMessage, 'secret key').toString(CryptoJS.enc.Utf8)"}Hashing
Crypto-js can be used to hash data using algorithms like SHA-256, SHA-512, MD5, and more. The code sample shows how to hash a message using SHA-256 and SHA-512.
{"SHA256": "CryptoJS.SHA256('message').toString()", "SHA512": "CryptoJS.SHA512('message').toString()"}HMAC (Hash-based Message Authentication Code)
This feature provides a way to verify both the data integrity and the authenticity of a message with a secret key. The code sample demonstrates generating an HMAC with the SHA-256 algorithm.
{"HMAC": "CryptoJS.HmacSHA256('message', 'secret').toString()"}Progressive Ciphering
For large amounts of data, progressive ciphering allows you to encrypt or decrypt data in chunks rather than all at once. The code sample demonstrates how to encrypt data progressively.
{"progressiveCiphering": "var aesEncryptor = CryptoJS.algo.AES.createEncryptor('secret key', { iv: CryptoJS.enc.Hex.parse('0000000000000000') }); var ciphertextPart1 = aesEncryptor.process('part1 '); var ciphertextPart2 = aesEncryptor.process('part2 '); var ciphertextPart3 = aesEncryptor.process('part3 '); var ciphertextPart4 = aesEncryptor.finalize(); var encryptedMessage = ciphertextPart1.concat(ciphertextPart2).concat(ciphertextPart3).concat(ciphertextPart4).toString();"}Secure Random Bytes Generation
Crypto-js can generate secure random bytes, which are useful for creating salts, keys, and other cryptographic elements. The code sample shows how to generate a random 16-byte string.
{"randomBytes": "CryptoJS.lib.WordArray.random(16).toString()"}bcryptjs is a pure JavaScript implementation of the bcrypt password hashing function. It is useful for securely storing passwords. Unlike crypto-js, which offers a variety of cryptographic operations, bcryptjs focuses specifically on password hashing and is often used for this purpose in web applications.
node-forge is a native JavaScript implementation of various networking and cryptography tools including TLS, SSH, and various cryptographic algorithms. It is similar to crypto-js but offers additional features like TLS and SSH protocol support, making it suitable for more complex cryptographic tasks.
libsodium-wrappers provides a high-level API for libsodium, a modern and easy-to-use crypto library. It offers similar functionalities to crypto-js but focuses on high-performance operations and is based on the NaCl library, which is designed to be fast and secure.
JavaScript library of crypto standards.
Requirements:
npm install crypto-js
ES6 import for typical API call signing use case:
import sha256 from 'crypto-js/sha256';
import hmacSHA512 from 'crypto-js/hmac-sha512';
import Base64 from 'crypto-js/enc-base64';
const message, nonce, path, privateKey; // ...
const hashDigest = sha256(nonce + message);
const hmacDigest = Base64.stringify(hmacSHA512(path + hashDigest, privateKey));
Modular include:
var AES = require("crypto-js/aes");
var SHA256 = require("crypto-js/sha256");
...
console.log(SHA256("Message"));
Including all libraries, for access to extra methods:
var CryptoJS = require("crypto-js");
console.log(CryptoJS.HmacSHA1("Message", "Key"));
Requirements:
bower install crypto-js
Modular include:
require.config({
packages: [
{
name: 'crypto-js',
location: 'path-to/bower_components/crypto-js',
main: 'index'
}
]
});
require(["crypto-js/aes", "crypto-js/sha256"], function (AES, SHA256) {
console.log(SHA256("Message"));
});
Including all libraries, for access to extra methods:
// Above-mentioned will work or use this simple form
require.config({
paths: {
'crypto-js': 'path-to/bower_components/crypto-js/crypto-js'
}
});
require(["crypto-js"], function (CryptoJS) {
console.log(CryptoJS.HmacSHA1("Message", "Key"));
});
<script type="text/javascript" src="path-to/bower_components/crypto-js/crypto-js.js"></script>
<script type="text/javascript">
var encrypted = CryptoJS.AES(...);
var encrypted = CryptoJS.SHA256(...);
</script>
See: https://cryptojs.gitbook.io/docs/
var CryptoJS = require("crypto-js");
// Encrypt
var ciphertext = CryptoJS.AES.encrypt('my message', 'secret key 123').toString();
// Decrypt
var bytes = CryptoJS.AES.decrypt(ciphertext, 'secret key 123');
var originalText = bytes.toString(CryptoJS.enc.Utf8);
console.log(originalText); // 'my message'
var CryptoJS = require("crypto-js");
var data = [{id: 1}, {id: 2}]
// Encrypt
var ciphertext = CryptoJS.AES.encrypt(JSON.stringify(data), 'secret key 123').toString();
// Decrypt
var bytes = CryptoJS.AES.decrypt(ciphertext, 'secret key 123');
var decryptedData = JSON.parse(bytes.toString(CryptoJS.enc.Utf8));
console.log(decryptedData); // [{id: 1}, {id: 2}]
crypto-js/corecrypto-js/x64-corecrypto-js/lib-typedarrayscrypto-js/md5crypto-js/sha1crypto-js/sha256crypto-js/sha224crypto-js/sha512crypto-js/sha384crypto-js/sha3crypto-js/ripemd160crypto-js/hmac-md5crypto-js/hmac-sha1crypto-js/hmac-sha256crypto-js/hmac-sha224crypto-js/hmac-sha512crypto-js/hmac-sha384crypto-js/hmac-sha3crypto-js/hmac-ripemd160crypto-js/pbkdf2crypto-js/aescrypto-js/tripledescrypto-js/rc4crypto-js/rabbitcrypto-js/rabbit-legacycrypto-js/evpkdfcrypto-js/format-opensslcrypto-js/format-hexcrypto-js/enc-latin1crypto-js/enc-utf8crypto-js/enc-hexcrypto-js/enc-utf16crypto-js/enc-base64crypto-js/mode-cfbcrypto-js/mode-ctrcrypto-js/mode-ctr-gladmancrypto-js/mode-ofbcrypto-js/mode-ecbcrypto-js/pad-pkcs7crypto-js/pad-ansix923crypto-js/pad-iso10126crypto-js/pad-iso97971crypto-js/pad-zeropaddingcrypto-js/pad-nopaddingRollback, 3.3.0 is the same as 3.1.9-1.
The move of using native secure crypto module will be shifted to a new 4.x.x version. As it is a breaking change the impact is too big for a minor release.
The usage of the native crypto module has been fixed. The import and access of the native crypto module has been improved.
In this version Math.random() has been replaced by the random methods of the native crypto module.
For this reason CryptoJS might does not run in some JavaScript environments without native crypto module. Such as IE 10 or before.
If it's absolute required to run CryptoJS in such an environment, stay with 3.1.x version. Encrypting and decrypting stays compatible. But keep in mind 3.1.x versions still use Math.random() which is cryptographically not secure, as it's not random enough.
This version came along with CRITICAL BUG.
DO NOT USE THIS VERSION! Please, go for a newer version!
The 3.1.x are based on the original CryptoJS, wrapped in CommonJS modules.
FAQs
JavaScript library of crypto standards.
The npm package crypto-js receives a total of 3,469,011 weekly downloads. As such, crypto-js popularity was classified as popular.
We found that crypto-js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.