crypto-js

CryptoJS is a widely used JavaScript library that implements a broad set of cryptographic standards in pure JavaScript, so the same code runs in Node.js and the browser without native bindings. It provides hashers (MD5, SHA-1, SHA-2, SHA-3, RIPEMD-160), HMAC, the PBKDF2 key-derivation function, and symmetric ciphers including AES, TripleDES, Rabbit, and RC4, along with a rich set of encoders, block-cipher modes, and padding schemes.

Its modular design lets you import only the algorithms you need (for example crypto-js/sha256 or crypto-js/aes) to keep bundles small, or pull in the full CryptoJS object for access to every primitive. Note that active development has been discontinued in favor of the platform-native Crypto module, but the library remains extremely popular for API signing, password hashing, and interoperable AES encryption.

What You Get

• Hash functions: MD5, SHA-1, SHA-224/256/384/512, SHA-3, and RIPEMD-160
• HMAC variants for every supported hash and the PBKDF2 key-derivation function
• Symmetric ciphers: AES, TripleDES, Rabbit, RC4, and Blowfish with OpenSSL-compatible formatting
• Configurable block-cipher modes (CBC, CFB, CTR, OFB, ECB) and padding schemes (PKCS7, ANSI X.923, ISO-10126, zero, no-padding)
• Encoders for Latin1, UTF-8, UTF-16, Hex, Base64, and URL-safe Base64

Common Use Cases

• Signing API requests by hashing and HMAC-signing payloads on the client
• Encrypting and decrypting data with AES that interoperates with OpenSSL and other implementations
• Deriving keys from passwords using PBKDF2 before encryption or storage

Under The Hood

Architecture

CryptoJS is organized as a single global CryptoJS object progressively extended by self-invoking modules. The foundation in src/core.js defines CryptoJS.lib (Base, WordArray, BufferedBlockAlgorithm, Hasher) and CryptoJS.enc, where WordArray - an array of 32-bit words plus a byte length - is the universal data type passed between every primitive. Algorithm modules such as src/sha256.js and src/aes.js register themselves onto CryptoJS.algo and expose convenience wrappers (e.g. CryptoJS.SHA256, CryptoJS.AES.encrypt); block ciphers layer through cipher-core.js, which supplies mode (mode-cbc) and padding (pad-pkcs7) strategies and the OpenSSL-compatible key-derivation/serialization format.

Tech Stack

The library is written in pure ES5 JavaScript with zero runtime dependencies, deliberately avoiding native bindings so identical code runs in Node.js, browsers, and web workers; the only platform touch point is core.js detecting a native crypto object for cryptographically secure random numbers. Builds are driven by Grunt (Gruntfile.js, grunt/) with JSHint linting configured via .jshintrc, and modules are authored as UMD-style IIFEs so both CommonJS require and AMD/RequireJS consumers work.

Code Quality

The repository carries a substantial test suite - roughly 66 files under test/ (e.g. aes-test.js, sha256-test.js, hmac-md5-test.js) exercising standard test vectors for each algorithm - giving good confidence in correctness against known-answer values. The code is mature and stable but shows its age: ES5 var declarations, no TypeScript types shipped in-tree, and terse single-letter shortcuts (C, C_lib, C_algo) that favor brevity over readability.

API Design

The public API is compact and ergonomic: hashing is a one-liner (CryptoJS.SHA256('message')), AES encryption returns a chainable CipherParams whose toString() yields OpenSSL-formatted ciphertext, and modular paths like crypto-js/sha256 keep bundles small. The main friction is stringly-typed configuration (passing a passphrase string vs. a WordArray key silently changes behavior) and reliance on external GitBook documentation rather than rich in-repo API docs, which can surprise newcomers around key handling.