Client-Side Cryptography: A Deep Dive into JS Libraries

Choosing a cryptography library in JavaScript is not just about picking an algorithm; it is about selecting a security model that fits your architecture. The five libraries discussed here—crypto-js, jsencrypt, node-forge, openpgp, and tweetnacl—solve different problems. Some are Swiss Army knives for legacy standards, while others are precision instruments for modern elliptic curve cryptography. Let's break down how they handle real-world engineering challenges.

🔐 Symmetric Encryption: AES and Data Privacy

When you need to encrypt data locally (like saving a user's draft to LocalStorage) or secure a channel with a shared secret, you typically reach for AES. However, the implementation details vary wildly.

crypto-js provides a very approachable API for AES. It supports various modes, but developers often default to CBC without realizing they also need to manage Initialization Vectors (IVs) manually to ensure security.

// crypto-js: AES Encryption
import CryptoJS from 'crypto-js';

const message = "Secret Data";
const key = "MySecretKey12345"; // Must be 16, 24, or 32 chars

// Default is CBC mode. You MUST generate a random IV for production.
const iv = CryptoJS.lib.WordArray.random(128/8);
const encrypted = CryptoJS.AES.encrypt(message, key, { iv: iv });

console.log(encrypted.toString());

node-forge handles AES with a more verbose, low-level API that gives you explicit control over every byte. It is excellent when you need to match a specific legacy system's exact padding or mode requirements.

// node-forge: AES Encryption
import forge from 'node-forge';

const message = "Secret Data";
const key = forge.random.getBytesSync(16); // 128-bit key
const iv = forge.random.getBytesSync(16);

const cipher = forge.cipher.createCipher('AES-CBC', key);
cipher.start({ iv: iv });
cipher.update(forge.util.createBuffer(message, 'utf8'));
cipher.finish();

const encrypted = cipher.output.getBytes();

tweetnacl does not support raw AES. Instead, it forces you to use crypto_secretbox, which combines XSalsa20 encryption and Poly1305 authentication. This prevents common mistakes like using AES without integrity checks, which can lead to padding oracle attacks.

// tweetnacl: Authenticated Encryption
import nacl from 'tweetnacl';

const message = nacl.util.decodeUTF8("Secret Data");
const nonce = nacl.randomBytes(nacl.secretbox.nonceLength);
const key = nacl.randomBytes(nacl.secretbox.keyLength);

const encryptedBox = nacl.secretbox(message, nonce, key);
// The result includes the authentication tag automatically

openpgp handles symmetric encryption differently. It is designed to encrypt sessions or files using a passphrase, automatically handling the complex packet structure of the OpenPGP standard.

// openpgp: Symmetric Encryption
import * as openpgp from 'openpgp';

const message = await openpgp.createMessage({ text: "Secret Data" });
const encrypted = await openpgp.encrypt({
  message,
  passwords: ['my-secret-passphrase'] // Uses SKESK (Symmetric Key Encrypted Session Key)
});

console.log(encrypted); // Returns armored PGP string

jsencrypt does not support symmetric encryption directly. It is strictly for RSA. To encrypt large data, you would typically generate a random AES key, encrypt the data with crypto-js, and then encrypt the AES key with jsencrypt.

🔑 Asymmetric Keys: RSA vs. Elliptic Curves

Public-key cryptography is essential for key exchange and digital signatures. The choice here defines your security posture and compatibility.

jsencrypt is the simplest way to get RSA working in the browser. It generates keys and encrypts small strings instantly. It is perfect for sending a login password or a session key to a server that holds the private RSA key.

// jsencrypt: RSA Key Generation & Encryption
import { JSEncrypt } from 'jsencrypt';

const encryptor = new JSEncrypt();
const keys = encryptor.generateKey(1024); // Generates 1024-bit pair

encryptor.setPublicKey(keys.publicKey);
const encrypted = encryptor.encrypt("Sensitive Token");

// Note: RSA can only encrypt data smaller than the key size.

node-forge offers a full RSA implementation including key generation, encryption, and signing. It allows you to manipulate the raw components (modulus, exponents) if you need to interoperate with Java or .NET systems that export keys in specific formats.

// node-forge: RSA Encryption
import forge from 'node-forge';

const pair = forge.pki.rsa.generateKeyPair(2048);
const publicKeyPem = forge.pki.publicKeyToPem(pair.publicKey);

const publicKey = forge.pki.publicKeyFromPem(publicKeyPem);
const encrypted = publicKey.encrypt("Sensitive Token", 'RSA-OAEP');

tweetnacl rejects RSA entirely in favor of Curve25519 (for encryption) and Ed25519 (for signatures). These curves are faster and safer against side-channel attacks. The API uses "boxes" where you combine your private key with the recipient's public key.

// tweetnacl: Elliptic Curve Encryption
import nacl from 'tweetnacl';

const recipientKeyPair = nacl.box.keyPair();
const myKeyPair = nacl.box.keyPair();

const message = nacl.util.decodeUTF8("Secure Message");
const nonce = nacl.randomBytes(nacl.box.nonceLength);

// Encrypts using recipient's public key and our private key
const encrypted = nacl.box(message, nonce, recipientKeyPair.publicKey, myKeyPair.secretKey);

openpgp manages complex key rings. It doesn't just encrypt; it binds identities to keys. You can encrypt a message to multiple recipients, and the library handles the session key encryption for each person automatically.

// openpgp: Multi-recipient Encryption
import * as openpgp from 'openpgp';

const recipientKeys = await openpgp.readKey({ armoredKey: publicKeyArmored });
const message = await openpgp.createMessage({ text: "Hello Alice and Bob" });

const encrypted = await openpgp.encrypt({
  message,
  encryptionKeys: [recipientKeys] // Can pass an array of keys
});

crypto-js does not support asymmetric cryptography. It is strictly for symmetric algorithms and hashing. Trying to implement RSA with crypto-js would require importing additional, non-standard plugins that are often unmaintained.

✍️ Digital Signatures and Integrity

Verifying that data hasn't been tampered with is critical for software updates, financial transactions, and API requests.

tweetnacl makes signing incredibly simple with crypto_sign. It produces a signature that is attached to the message, ensuring both integrity and authenticity using Ed25519.

// tweetnacl: Signing
import nacl from 'tweetnacl';

const keyPair = nacl.sign.keyPair();
const message = nacl.util.decodeUTF8("Do not transfer funds");

const signedMessage = nacl.sign(message, keyPair.secretKey);
// signedMessage contains both the original message and the signature

const isValid = nacl.sign.open(signedMessage, keyPair.publicKey) !== null;

node-forge provides detailed control over signing, allowing you to choose hash algorithms (SHA-256, SHA-1) and padding schemes explicitly. This is necessary when verifying signatures from legacy Certificate Authorities.

// node-forge: Signing
import forge from 'node-forge';

const md = forge.md.sha256.create();
md.update("Data to sign", 'utf8');

const privateKey = forge.pki.privateKeyFromPem(pemString);
const signature = privateKey.sign(md);

// Verification requires re-hashing and comparing

openpgp creates detached signatures or cleartext signed messages that are compatible with GPG command-line tools. This is the standard for verifying software releases (e.g., verifying a Linux distro ISO).

// openpgp: Detached Signature
import * as openpgp from 'openpgp';

const signingKey = await openpgp.readPrivateKey({ armoredKey: privateKeyArmored });
const message = await openpgp.createMessage({ text: "Release v1.0" });

const signature = await openpgp.sign({
  message,
  signingKeys: signingKey,
  detached: true // Returns only the signature packet
});

crypto-js handles hashing (SHA-256, HMAC) but does not create public/private key signatures. You can create an HMAC if both parties share a secret, but you cannot prove identity to a third party without a private key.

// crypto-js: HMAC (Shared Secret Integrity)
import CryptoJS from 'crypto-js';

const hash = CryptoJS.HmacSHA256("Message", "SharedSecret");
// This proves integrity but not identity to outsiders

jsencrypt supports RSA signing, but it is basic. It is useful if you need to sign a challenge-response authentication token using an RSA key pair generated in the browser.

// jsencrypt: RSA Signing
import { JSEncrypt } from 'jsencrypt';

const encryptor = new JSEncrypt();
encryptor.setPrivateKey(privateKeyPem);

const signature = encryptor.sign("Data to sign", "SHA256", "PKCS1v1.5");

🛠️ PKI and Certificate Handling

This is where the libraries diverge most sharply. Most web developers never touch X.509 certificates in the browser, but when you do, there is really only one choice.

node-forge is the undisputed leader here. It can parse PEM files, read Certificate Revocation Lists (CRLs), and even act as a Certificate Authority (CA) to issue new certificates entirely in client-side code. No other library on this list comes close to this capability.

// node-forge: Parsing a Certificate
import forge from 'node-forge';

const certPem = "-----BEGIN CERTIFICATE-----...";
const cert = forge.pki.certificateFromPem(certPem);

console.log(cert.subject.getField('CN').value); // Extract Common Name
console.log(cert.validity.notAfter); // Check expiration

openpgp manages its own form of PKI via the "Web of Trust," which is different from the X.509 hierarchy used by TLS. It handles key revocation certificates and user IDs within the PGP standard.

// openpgp: Revocation
import * as openpgp from 'openpgp';

const privateKey = await openpgp.readPrivateKey({ armoredKey: keyArmored });
const revocationCert = await privateKey.getRevocationCertificate();
// This certificate can be published to prove the key is no longer valid

crypto-js, jsencrypt, and tweetnacl have zero support for X.509 certificates or PKI infrastructure. They operate purely on raw keys and data buffers.

🧩 Interoperability and Standards

If your frontend needs to talk to a specific backend ecosystem, your choice is often made for you.

• Legacy Enterprise / .NET / Java: If your backend uses standard Java javax.crypto or .NET System.Security.Cryptography, crypto-js is often the easiest match for AES and SHA. node-forge is required if the backend exchanges X.509 certificates.
• Modern Microservices / Go / Rust: These languages often favor modern curves. tweetnacl (or its wrapper nacl-fast) aligns perfectly with libsodium-based backends, offering better performance and security defaults.
• Email / Security Tools: If you are building a secure email client or a tool that must verify gpg --verify output, openpgp is the only viable option.
• Simple Handshakes: For a quick login flow where the browser encrypts a password with a server's public key, jsencrypt reduces boilerplate significantly.

📊 Summary Comparison

💡 The Architect's Recommendation

For new, security-critical applications, start with tweetnacl. Its API forces you into safe patterns (authenticated encryption) and uses modern math that is resistant to many attacks that plague older RSA/AES implementations. It is small, fast, and hard to misuse.

If you are building infrastructure tools that need to read certificates, generate CSRs, or interact with a traditional PKI, node-forge is your only real option in pure JavaScript. It is heavy, but it is the most powerful toolkit available.

Use openpgp strictly when you need compatibility with the PGP ecosystem (email, file signing). Do not use it for general-purpose HTTPS-style encryption; it is over-engineered for that.

Reserve crypto-js and jsencrypt for maintenance of legacy systems or for very specific, low-risk tasks like hashing a password before transmission (though HTTPS makes this redundant) or simple RSA handshakes where introducing a larger library is not justified. In greenfield projects requiring robust security, prefer the modern guarantees of tweetnacl or the comprehensive standards of openpgp.