Having not been updated in many years (except to fix one serious vulnerability, described below), sjcl is deprecated. Please do not use it in new projects, and consider instead a more modern alternative.
Stanford Javascript Crypto Library
12.02.2014: the current development version has a paranoia bug in the ecc module. The bug was introduced in commit ac0b3fe0 and might affect ecc key generation on platforms without a platform random number generator.
03.08.2026: According to https://gist.github.com/Kr0emer/2560f98edb10b0b34f2438cd63913c47, sjcl is vulnerable due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey(). An attacker can recover a victim's ECDH private key by sending crafted off-curve public keys and observing ECDH outputs. The dhJavaEc() function directly returns the raw x-coordinate of the scalar multiplication result (no hashing), providing a plaintext oracle without requiring any decryption feedback. This bug is fixed in SJCL 1.0.9. Thanks to Kr0emer for reporting it, and to the the Snyk security team for relaying this information.
Security Mail: sjcl@ovt.me
OpenPGP-Key Fingerprint: 0D54 3E52 87B4 EC06 3FA9 0115 72ED A6C7 7AAF 48ED
Keyserver: pool.sks-keyservers.net
codecBase32 has been re-enabled with changes to conform to RFC 4648:
= is now applied to the output of fromBits. If you don't want that padding, you can disable it by calling fromBits with a second parameter of true or anything that evaluates as "truthy" in JSsjcl.codec.base32 now matches that specified by the RFC, rather than the extended hex alphabet.sjcl.codec.base32hex (also matching the RFC). So if you encoded something with base32 before, you'll want to decode it with base32hex now.The documentation is available here
CryptoJS is a widely-used library that provides standard and secure cryptographic algorithms for JavaScript. It supports a variety of cryptographic functions including AES encryption, SHA hashing, and HMAC. Compared to SJCL, CryptoJS offers a broader range of algorithms and is more commonly used in the JavaScript community.
Forge is a comprehensive cryptographic library for JavaScript that supports a wide range of cryptographic functions including encryption, hashing, and digital signatures. It also provides tools for working with X.509 certificates and TLS. Forge is more feature-rich compared to SJCL and is suitable for more complex cryptographic tasks.
TweetNaCl is a cryptographic library that focuses on simplicity and security. It provides a small set of high-level cryptographic functions including public-key encryption, secret-key encryption, and hashing. Compared to SJCL, TweetNaCl is designed to be minimalistic and easy to audit, making it a good choice for security-critical applications.
FAQs
Stanford Javascript Crypto Library
The npm package sjcl receives a total of 193,455 weekly downloads. As such, sjcl popularity was classified as popular.
We found that sjcl demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A compromised jscrambler npm release added a malicious preinstall hook that runs hidden native binaries on Linux, macOS, and Windows.
Research
/Security News
A malicious .NET package is typosquatting the Braintree SDK to steal live payment card data, merchant API keys, and host secrets from production apps.
Security News
/Research
Compromised Injective SDK npm version 1.20.21 exfiltrates wallet private keys and mnemonics through fake telemetry functionality.