crypto-js vs bcrypt vs crypto vs jsrsasign vs node-forge vs node-rsa vs openpgp
JavaScript Cryptography Libraries
crypto-jsbcryptcryptojsrsasignnode-forgenode-rsaopenpgpSimilar Packages:

JavaScript Cryptography Libraries

JavaScript cryptography libraries provide developers with tools to implement secure data encryption, decryption, hashing, and signing functionalities in their applications. These libraries are essential for protecting sensitive information, ensuring data integrity, and enabling secure communications. Each library has its own strengths and use cases, catering to various security needs in web development.

Npm Package Weekly Downloads Trend

3 Years

Github Stars Ranking

Stat Detail

Package
Downloads
Stars
Size
Issues
Publish
License
crypto-js13,982,95616,392487 kB2752 years agoMIT
bcrypt07,7771.11 MB3010 months agoMIT
crypto032-149 years agoISC
jsrsasign03,367882 kB3514 days agoMIT
node-forge05,2741.64 MB4583 months ago(BSD-3-Clause OR GPL-2.0)
node-rsa01,383-306 years agoMIT
openpgp05,93917.3 MB393 months agoLGPL-3.0+

Feature Comparison: crypto-js vs bcrypt vs crypto vs jsrsasign vs node-forge vs node-rsa vs openpgp

Password Hashing

  • crypto-js:

    crypto-js does not focus on password hashing but provides hashing functions like SHA-256 and HMAC. It is not recommended for password storage due to the absence of salting and adaptive features.

  • bcrypt:

    bcrypt is designed specifically for hashing passwords. It incorporates a unique salt for each password and uses an adaptive hashing algorithm, making it resistant to brute-force attacks. The work factor can be adjusted to increase the computational cost of hashing, enhancing security over time.

  • crypto:

    The crypto module does not provide a dedicated password hashing function, but it can be used to create hashes using algorithms like SHA-256. However, it lacks the built-in salting and adaptive features of bcrypt, making it less suitable for password storage.

Encryption Algorithms

  • crypto-js:

    crypto-js offers a wide range of encryption algorithms, including AES, DES, and Triple DES, making it a flexible choice for client-side encryption in web applications.

  • bcrypt:

    bcrypt does not provide encryption capabilities; it is solely focused on password hashing and verification.

  • crypto:

    The crypto module supports various encryption algorithms, including AES and RSA, making it versatile for different encryption needs. It is suitable for both symmetric and asymmetric encryption tasks.

Advanced Cryptographic Features

  • jsrsasign:

    jsrsasign provides advanced features such as JWT signing, X.509 certificate handling, and support for various cryptographic standards, making it suitable for secure token-based authentication and certificate management.

  • node-forge:

    node-forge offers a comprehensive set of cryptographic tools, including support for TLS, PKI, and various encryption algorithms. It is ideal for applications that require complex cryptographic operations and protocols.

  • node-rsa:

    node-rsa focuses on RSA encryption and decryption, providing a simple interface for key generation and management. It is specifically tailored for applications that require asymmetric encryption.

Client-Side Usage

  • crypto-js:

    crypto-js is designed for client-side use, making it easy to integrate into web applications for encryption and hashing without server dependencies.

  • bcrypt:

    bcrypt is not suitable for client-side use due to its computational intensity and the need for secure password handling on the server side.

  • crypto:

    The crypto module is server-side only and cannot be used in client-side applications, limiting its usability to Node.js environments.

OpenPGP Support

  • jsrsasign:

    jsrsasign provides limited support for OpenPGP standards, focusing more on JWT and certificate handling than on full OpenPGP functionalities.

  • node-forge:

    node-forge includes some OpenPGP functionalities, allowing for the creation and verification of signatures, but it is not a full OpenPGP implementation.

  • openpgp:

    openpgp is a dedicated library for implementing OpenPGP standards, providing comprehensive support for encrypting, signing, and managing keys in accordance with the OpenPGP protocol.

How to Choose: crypto-js vs bcrypt vs crypto vs jsrsasign vs node-forge vs node-rsa vs openpgp

  • crypto-js:

    Select crypto-js for client-side cryptography in web applications. It is a pure JavaScript implementation that allows for easy integration into front-end projects, providing various algorithms for encryption and hashing.

  • bcrypt:

    Choose bcrypt for password hashing when you need a secure and reliable way to store user passwords. It is specifically designed for this purpose and includes features like salting and adjustable work factors to enhance security.

  • crypto:

    Use the built-in crypto module in Node.js for general-purpose cryptographic operations. It is suitable for applications that require basic cryptographic functions such as hashing, HMAC, and encryption without needing an external dependency.

  • jsrsasign:

    Opt for jsrsasign when you need advanced cryptographic features, such as JWT signing, X.509 certificate handling, and RSA key generation. It is particularly useful for applications that require secure token-based authentication.

  • node-forge:

    Choose node-forge for a comprehensive suite of cryptographic tools that includes support for TLS, PKI, and various encryption algorithms. It is ideal for applications that need to handle complex cryptographic tasks and protocols.

  • node-rsa:

    Use node-rsa when you specifically need RSA key generation, encryption, and decryption. It is a straightforward library for working with RSA keys and is suitable for applications that require asymmetric encryption.

  • openpgp:

    Select openpgp for implementing OpenPGP standards in your applications. It is ideal for encrypting and signing messages, ensuring secure communication, and is particularly useful in email encryption scenarios.

README for crypto-js

crypto-js

JavaScript library of crypto standards.

Discontinued

Active development of CryptoJS has been discontinued. This library is no longer maintained.

Nowadays, NodeJS and modern browsers have a native Crypto module. The latest version of CryptoJS already uses the native Crypto module for random number generation, since Math.random() is not crypto-safe. Further development of CryptoJS would result in it only being a wrapper of native Crypto. Therefore, development and maintenance has been discontinued, it is time to go for the native crypto module.

Node.js (Install)

Requirements:

  • Node.js
  • npm (Node.js package manager)
npm install crypto-js

Usage

ES6 import for typical API call signing use case:

import sha256 from 'crypto-js/sha256';
import hmacSHA512 from 'crypto-js/hmac-sha512';
import Base64 from 'crypto-js/enc-base64';

const message, nonce, path, privateKey; // ...
const hashDigest = sha256(nonce + message);
const hmacDigest = Base64.stringify(hmacSHA512(path + hashDigest, privateKey));

Modular include:

var AES = require("crypto-js/aes");
var SHA256 = require("crypto-js/sha256");
...
console.log(SHA256("Message"));

Including all libraries, for access to extra methods:

var CryptoJS = require("crypto-js");
console.log(CryptoJS.HmacSHA1("Message", "Key"));

Client (browser)

Requirements:

  • Node.js
  • Bower (package manager for frontend)
bower install crypto-js

Usage

Modular include:

require.config({
    packages: [
        {
            name: 'crypto-js',
            location: 'path-to/bower_components/crypto-js',
            main: 'index'
        }
    ]
});

require(["crypto-js/aes", "crypto-js/sha256"], function (AES, SHA256) {
    console.log(SHA256("Message"));
});

Including all libraries, for access to extra methods:

// Above-mentioned will work or use this simple form
require.config({
    paths: {
        'crypto-js': 'path-to/bower_components/crypto-js/crypto-js'
    }
});

require(["crypto-js"], function (CryptoJS) {
    console.log(CryptoJS.HmacSHA1("Message", "Key"));
});

Usage without RequireJS

<script type="text/javascript" src="path-to/bower_components/crypto-js/crypto-js.js"></script>
<script type="text/javascript">
    var encrypted = CryptoJS.AES(...);
    var encrypted = CryptoJS.SHA256(...);
</script>

API

See: https://cryptojs.gitbook.io/docs/

AES Encryption

Plain text encryption

var CryptoJS = require("crypto-js");

// Encrypt
var ciphertext = CryptoJS.AES.encrypt('my message', 'secret key 123').toString();

// Decrypt
var bytes  = CryptoJS.AES.decrypt(ciphertext, 'secret key 123');
var originalText = bytes.toString(CryptoJS.enc.Utf8);

console.log(originalText); // 'my message'

Object encryption

var CryptoJS = require("crypto-js");

var data = [{id: 1}, {id: 2}]

// Encrypt
var ciphertext = CryptoJS.AES.encrypt(JSON.stringify(data), 'secret key 123').toString();

// Decrypt
var bytes  = CryptoJS.AES.decrypt(ciphertext, 'secret key 123');
var decryptedData = JSON.parse(bytes.toString(CryptoJS.enc.Utf8));

console.log(decryptedData); // [{id: 1}, {id: 2}]

List of modules

  • crypto-js/core
  • crypto-js/x64-core
  • crypto-js/lib-typedarrays

  • crypto-js/md5
  • crypto-js/sha1
  • crypto-js/sha256
  • crypto-js/sha224
  • crypto-js/sha512
  • crypto-js/sha384
  • crypto-js/sha3
  • crypto-js/ripemd160

  • crypto-js/hmac-md5
  • crypto-js/hmac-sha1
  • crypto-js/hmac-sha256
  • crypto-js/hmac-sha224
  • crypto-js/hmac-sha512
  • crypto-js/hmac-sha384
  • crypto-js/hmac-sha3
  • crypto-js/hmac-ripemd160

  • crypto-js/pbkdf2

  • crypto-js/aes
  • crypto-js/tripledes
  • crypto-js/rc4
  • crypto-js/rabbit
  • crypto-js/rabbit-legacy
  • crypto-js/evpkdf

  • crypto-js/format-openssl
  • crypto-js/format-hex

  • crypto-js/enc-latin1
  • crypto-js/enc-utf8
  • crypto-js/enc-hex
  • crypto-js/enc-utf16
  • crypto-js/enc-base64

  • crypto-js/mode-cfb
  • crypto-js/mode-ctr
  • crypto-js/mode-ctr-gladman
  • crypto-js/mode-ofb
  • crypto-js/mode-ecb

  • crypto-js/pad-pkcs7
  • crypto-js/pad-ansix923
  • crypto-js/pad-iso10126
  • crypto-js/pad-iso97971
  • crypto-js/pad-zeropadding
  • crypto-js/pad-nopadding

Release notes

4.2.0

Change default hash algorithm and iteration's for PBKDF2 to prevent weak security by using the default configuration.

Custom KDF Hasher

Blowfish support

4.1.1

Fix module order in bundled release.

Include the browser field in the released package.json.

4.1.0

Added url safe variant of base64 encoding. 357

Avoid webpack to add crypto-browser package. 364

4.0.0

This is an update including breaking changes for some environments.

In this version Math.random() has been replaced by the random methods of the native crypto module.

For this reason CryptoJS might not run in some JavaScript environments without native crypto module. Such as IE 10 or before or React Native.

3.3.0

Rollback, 3.3.0 is the same as 3.1.9-1.

The move of using native secure crypto module will be shifted to a new 4.x.x version. As it is a breaking change the impact is too big for a minor release.

3.2.1

The usage of the native crypto module has been fixed. The import and access of the native crypto module has been improved.

3.2.0

In this version Math.random() has been replaced by the random methods of the native crypto module.

For this reason CryptoJS might does not run in some JavaScript environments without native crypto module. Such as IE 10 or before.

If it's absolute required to run CryptoJS in such an environment, stay with 3.1.x version. Encrypting and decrypting stays compatible. But keep in mind 3.1.x versions still use Math.random() which is cryptographically not secure, as it's not random enough.

This version came along with CRITICAL BUG.

DO NOT USE THIS VERSION! Please, go for a newer version!

3.1.x

The 3.1.x are based on the original CryptoJS, wrapped in CommonJS modules.