Auditable and minimal JavaScript implementation of post-quantum public-key cryptography algorithms, including ML-KEM, ML-DSA, SLH-DSA, and Falcon.
noble-post-quantum is a JavaScript library that provides implementations of post-quantum cryptography algorithms, including key encapsulation mechanisms (ML-KEM) and digital signature schemes (ML-DSA, SLH-DSA, Falcon). It solves the problem of securing communications and data against future quantum computer attacks by offering standardized, auditable cryptographic primitives.
Developers and organizations building cryptographic systems, secure messaging apps, or digital signature solutions that need to be resilient against quantum computing threats, especially those planning for compliance with NIST and ASD post-2030 guidelines.
Developers choose noble-post-quantum for its auditable, minimal codebase, adherence to FIPS standards, and inclusion of hybrid algorithms that ease the transition from classical to post-quantum cryptography, all within a lightweight, tree-shakeable JavaScript package.
Auditable & minimal JS implementation of public-key post-quantum cryptography
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
The library is written in highly readable TypeScript/JavaScript, designed for easy security review and transparency, aligning with the noble cryptography philosophy of auditability.
Unused algorithms are excluded during bundling, reducing final bundle size to as low as 16KB gzipped for all included algorithms, as highlighted in the README.
Implements NIST-standardized post-quantum algorithms like ML-KEM (FIPS-203) and ML-DSA (FIPS-204), ensuring future-proof compliance with regulatory guidelines.
Relies only on noble-hashes and noble-curves, minimizing supply-chain risk and keeping the codebase lean, as stated in the dependencies section.
The README admits there is no protection against side-channel attacks, making it unsuitable for secure environments where timing attacks are a concern.
Algorithms like SLH-DSA are extremely slow, with benchmarks showing signing operations taking up to 3.8 seconds, which can cripple performance-sensitive applications.
The library has only been self-audited, not independently verified, raising risks for production use in security-critical systems despite its transparency.