{"id":40772,"library":"crypto-javascript","title":"crypto-js","description":"JavaScript library of cryptographic standards. Provides implementations of hash functions (MD5, SHA-1, SHA-256, SHA3, RIPEMD-160), HMAC, symmetric ciphers (AES, DES, TripleDES, RC4, Rabbit, RabbitLegacy, PBKDF2, EvpKDF) and encoders (Base64, Hex, Latin1, Utf8, Utf16). Ideal for client-side encryption where Node.js crypto module is unavailable. Version 4.3.6 is the latest stable release. It is a direct port of popular C++ crypto++ library algorithms to JavaScript, with no external dependencies. Not recommended for new projects due to security concerns (insecure default modes, lack of authenticated encryption). Use the Web Crypto API or Node.js crypto module instead.","status":"active","version":"4.3.6","language":"javascript","source_language":"en","source_url":"http://github.com/brix/crypto-js","tags":["javascript","security","crypto","Hash","MD5","SHA1","SHA-1","SHA256","SHA-256"],"install":[{"cmd":"npm install crypto-javascript","lang":"bash","label":"npm"},{"cmd":"yarn add crypto-javascript","lang":"bash","label":"yarn"},{"cmd":"pnpm add crypto-javascript","lang":"bash","label":"pnpm"}],"dependencies":[],"imports":[{"note":"Default import from module; named import not available.","wrong":"import { AES } from 'crypto-js'","symbol":"AES","correct":"import AES from 'crypto-js/aes'"},{"note":"ESM default import works; require works but is CommonJS.","wrong":"const SHA256 = require('crypto-js').SHA256","symbol":"SHA256","correct":"import SHA256 from 'crypto-js/sha256'"},{"note":"crypto-js uses deep imports for tree shaking; full library import works but not tree-shakeable.","wrong":"import { enc } from 'crypto-js'; enc.Hex","symbol":"enc.Hex","correct":"import encHex from 'crypto-js/enc-hex'"}],"quickstart":{"code":"import AES from 'crypto-js/aes';\nimport encUtf8 from 'crypto-js/enc-utf8';\nimport encBase64 from 'crypto-js/enc-base64';\n\nconst key = 'Secret Passphrase';\nconst plaintext = 'Hello World';\n\n// Encrypt\nconst ciphertext = AES.encrypt(plaintext, key).toString();\nconsole.log('Ciphertext:', ciphertext);\n\n// Decrypt\nconst bytes = AES.decrypt(ciphertext, key);\nconst decrypted = bytes.toString(encUtf8);\nconsole.log('Decrypted:', decrypted);","lang":"typescript","description":"Encrypt and decrypt a string using AES with a passphrase. Shows import of specific modules and conversion to/from strings."},"warnings":[{"fix":"Use Web Crypto API (SubtleCrypto) or Node.js crypto module with authenticated encryption like AES-GCM.","message":"crypto-js uses insecure defaults: ECB mode and no padding. This is vulnerable to pattern analysis.","severity":"deprecated","affected_versions":">=0.0.0"},{"fix":"Always handle decryption result: if returned string is empty, decryption failed.","message":"When encrypting with a passphrase, crypto-js uses a default 256-bit key, but the salt is random and not stored. Decryption fails if passphrase is wrong but no error thrown.","severity":"gotcha","affected_versions":">=0.0.0"},{"fix":"Use deep imports like 'crypto-js/aes' instead of 'crypto-js'.","message":"In version 4.0.0, the package was rewritten as ECMAScript modules. Import paths changed.","severity":"breaking","affected_versions":">=4.0.0"}],"env_vars":null,"search_vec":"'-1':16,109 '-160':21 '-256':18,112 '4.3.6':53 'ae':25 'algorithm':69 'api':96 'authent':90 'base64':35 'c':66 'cipher':24 'client':43 'client-sid':42 'concern':84 'crypto':2,48,67,95,99,104 'crypto-j':1 'cryptograph':7 'default':86 'depend':75 'des':26 'direct':62 'due':81 'encod':34 'encrypt':45,91 'evpkdf':32 'extern':74 'function':13 'hash':12,105 'hex':36 'hmac':22 'ideal':40 'implement':10 'insecur':85 'instead':101 'javascript':4,71,102 'js':3 'lack':88 'latest':56 'latin1':37 'librari':5,68 'md5':14,106 'mode':87 'modul':49,100 'new':79 'node.js':47,98 'pbkdf2':31 'popular':65 'port':63 'project':80 'provid':9 'rabbit':29 'rabbitlegaci':30 'rc4':28 'recommend':77 'releas':58 'ripemd':20 'secur':83,103 'sha':15,17,108,111 'sha1':107 'sha256':110 'sha3':19 'side':44 'stabl':57 'standard':8 'symmetr':23 'tripled':27 'unavail':51 'use':92 'utf16':39 'utf8':38 'version':52 'web':94","created_at":"2026-06-04T18:49:11.696562+00:00","updated_at":"2026-06-04T18:49:11.696562+00:00","problems":[{"fix":"Only import modules listed in package.json, e.g., 'crypto-js/aes' or 'crypto-js/sha256'.","cause":"Importing internal modules not exposed in package.json exports.","error":"Error: Cannot find module 'crypto-js/core'"},{"fix":"Use .toString(encUtf8) or .toString(encHex).","cause":"Decrypt result is a WordArray object; .toString() works but requires an encoder.","error":"TypeError: AES.decrypt(...).toString is not a function"}],"ecosystem":"npm","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":null,"cli_version":null,"type":"library","homepage":"http://github.com/brix/crypto-js","github":"http://github.com/brix/crypto-js","docs":null,"changelog":null,"pypi":null,"npm":"crypto-javascript","openapi_spec":null,"status_page":null,"smithery":null,"categories":["security"],"base_url":null,"auth_type":null,"provenance":{"verified_status":null,"verified_at":null,"last_verified":"2026-06-04","next_check":"2026-09-02","install_tag":null}}