Audited, minimal JavaScript implementation of cryptographic hash functions, MACs, and KDFs.
noble-hashes is an audited, minimal JavaScript library implementing a wide range of cryptographic hash functions, message authentication codes (MACs), and key derivation functions (KDFs). It provides developers with a secure, performant, and easily auditable alternative to native WebCrypto or other cryptographic libraries, focusing on reliability and small bundle sizes.
JavaScript and TypeScript developers building applications that require cryptographic hashing, message authentication, or key derivation, particularly those prioritizing security, auditability, and minimal dependencies.
Developers choose noble-hashes for its independent security audits, zero dependencies, tree-shakable design, and comprehensive algorithm support, offering a trustworthy and performant cryptographic foundation without the complexity of native WebCrypto.
Audited & minimal JS implementation of hash functions, MACs and KDFs.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Independently audited by Cure53 and self-audited, with transparent reports and rare releasing to minimize re-audit needs, ensuring high trustworthiness.
Zero runtime dependencies and tree-shakable builds keep bundle sizes small; the README notes 2.4KB for single-hash builds, optimizing for web apps.
Supports a wide range of hashes, MACs, and KDFs including SHA-2, SHA-3, BLAKE, Scrypt, and Argon2, covering most cryptographic use cases without needing multiple libraries.
Hand-optimized for JavaScript engine caveats with provided benchmarks, though it avoids unrolled loops to maintain readability and manageable bundle size.
Version 2 is ESM-only, which can disrupt projects using CommonJS or older build systems without transpilation, as noted in the upgrading section.
v2 only accepts Uint8Array inputs and prohibits strings, forcing developers to use utils like utf8ToBytes for conversion, adding complexity for common use cases.
Acknowledged to be slower than native or WASM alternatives; for example, the README warns that Argon2 is 5x slower in JS, and large Scrypt parameters may not be fully supported in all engines.