Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
By Ahmad Nassri - Apr 01, 2026
New Research: Supply Chain Attack on Axios Pulls Malicious Dependency from npm.Details → →
websnark
A fast zkSnark proof and verifier generator written in native Web Assembly.
websnark is used to generate zkSnark Proofs and verify the from the browser.
This module generates highly optimized Web Assembly modules for the low level cryptographic primitives.
It also makes use of the Web Workers feature to parallelize the generation and verification of the zero knoledge proofs.
The result is a fast library with times close to libsnarks but fully compatible for browsers.
Usage
BN128
You just need to import the websnark_bn128.js found in the build directory.
<script src="websnark_bn128.js" />
This library has a single javascript function:
genZKSnarkProof(witness, provingKey, cb)
cb is the callback. If cb is undefined, then the function will return a promise.
witness is a binary buffer with all the signals in binnary format. The buffer is packt in 32bytes Little Endian Encoded Field Elements.
You can use the tool to build the binary file from the witness.json file generated by snarkjs.
IMPORTANT: Please be sure you run your setup with --protocol groth websnark only generates groth16 proofs!
node ../tools/buildwitness.js -i witness.json -o witness.bin
provingKey is the binary buffer with the binary representation of the proving key.
Check the tool tools/buildpkey.js to convert a proving_key.json file generated in snarkjs to a proving_key.bin file that can be used directly with this library.
node ../tools/buildpkey.js -i proving_key.json -o proving_key.bin
The result is a JSON object with pi_a, pi_b and pi_c points.
You can use the stringified version of this JSON as a proof.json in snarkjs
Here is a simple example of a web page that loads a key and a witness and generates the proof when the button is pressed.
<html>
<header>
</header>
<script src="websnark_bn128.js"></script>
<script>
var witness;
var proving_key;
function onLoad() {
fetch("proving_key.bin").then( (response) => {
return response.arrayBuffer();
}).then( (b) => {
provingKey = b;
});
fetch("witness.bin").then( (response) => {
return response.arrayBuffer();
}).then( (b) => {
witness = b;
});
}
function calcProof() {
const start = new Date().getTime();
document.getElementById("time").innerHTML = "processing....";
document.getElementById("proof").innerHTML = "";
window.genZKSnarkProof(witness, provingKey).then((p)=> {
const end = new Date().getTime();
const time = end - start;
document.getElementById("time").innerHTML = `Time to compute: ${time}ms`;
document.getElementById("proof").innerHTML = JSON.stringify(p, null, 1);
});
}
</script>
<body onLoad="onLoad()">
<h1>iden3</h1>
<h2>Zero knowledge proof generator</h2>
<button onClick="calcProof()">Test</button>
<div id="time"></div>
<pre id="proof"></pre>
</body>
</html>
You can test it by running a web server on the example directory
npm -g install http-server
cd example/bn128
http-server .
And then navegate to http://127.0.0.1:8080
The generated proof can be cut and pasted to example/bn128/proof.json and tested with snarkjs
snarkjs verify
MNT6753
The directory example/mnt6753 contains an example of the verifier.
Building wasm.js
npm run build
Testing
npm test
License
websnark is part of the iden3 project copyright 2019 0KIMS association and published with GPL-3 license. Please check the COPYING file for more details.
FAQs
big integer library to work in Zq
The npm package websnark receives a total of 99 weekly downloads. As such, websnark popularity was classified as not popular.
We found that websnark demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Package last updated on 02 Aug 2019
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Related posts
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
By Socket Research Team - Mar 31, 2026
Research
TeamPCP Compromises Telnyx Python SDK to Deliver Credential-Stealing Malware
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.
By Socket Research Team - Mar 27, 2026