Audited, minimal JavaScript implementation of Salsa20, ChaCha, and AES encryption algorithms.
noble-ciphers is an audited, minimal JavaScript library that implements symmetric encryption algorithms like Salsa20, ChaCha, and AES. It provides developers with secure, performant, and tree-shakeable cryptographic primitives for applications requiring encryption, decryption, and authenticated encryption. The library solves the need for reliable, easy-to-audit crypto implementations in JavaScript without heavy dependencies.
JavaScript and TypeScript developers building applications that require encryption, such as secure messaging, data storage, or cryptographic tooling. It is also suitable for security-conscious teams needing audited, transparent crypto code.
Developers choose noble-ciphers for its combination of security (independently audited), performance (hand-optimized), and minimalism (tree-shakeable, small bundle size). It offers a comprehensive set of ciphers with a clean API, dual AES implementations, and is part of the trusted noble cryptography ecosystem.
Audited & minimal JS implementation of Salsa20, ChaCha and AES
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Independently audited by Cure53 and self-audited, with transparent reports available, ensuring high confidence in security practices as highlighted in the README's security section.
Tree-shakeable design excludes unused code, with the full library weighing only 11KB gzipped and ChaCha-only builds at 3KB, keeping applications lightweight.
Implementations are optimized for JavaScript engines, with benchmarks showing fast operations like ChaCha20 at over 1M ops/sec for 64B data, as detailed in the speed section.
Includes a wide range of ciphers such as AES in ECB, CBC, CTR, GCM, SIV modes, and Salsa20/ChaCha variants with Poly1305, providing flexibility for different use cases.
Version 2 is ESM-only, breaking compatibility with CommonJS projects and requiring migration efforts, as noted in the upgrading section, which could disrupt existing codebases.
The library admits that achieving constant-time execution in JavaScript is challenging due to JIT and GC, potentially exposing timing attacks, as discussed in the security section on constant-timeness.
Users must carefully handle nonces to avoid reuse, with encryption limits for ciphers like AES-GCM, increasing the potential for security errors if not implemented correctly.