JSEncrypt

JSEncrypt is an 18.5 kB gzipped, zero-dependency JavaScript library that performs OpenSSL-compatible RSA encryption, decryption, digital signing, and key generation in both the browser and Node.js. It wraps Tom Wu’s battle-tested jsbn big-number library without modifying its core algorithms, giving developers a simple, PEM-key-compatible API on top of a proven cryptographic foundation.

Because it supports both synchronous and asynchronous execution and understands standard PKCS#1/PKCS#8 PEM key formats generated by OpenSSL, it slots easily into existing key-management workflows — teams that already generate keys via openssl genrsa can drop JSEncrypt in purely for the JavaScript-side encrypt/decrypt/sign/verify operations.

What You Get

• RSA encryption, decryption, and OAEP-padded encryption via a single JSEncrypt class
• Digital signing and verification (signSha256/verifySha256 and other hash variants: md2, md5, sha1, sha224, sha256, sha384, sha512, ripemd160)
• OpenSSL-compatible PEM key parsing (PKCS#1 private keys, PKCS#8 public keys)
• Built-in JavaScript RSA key pair generation (512- to 4096-bit) for prototyping and non-critical use
• Works identically in browsers (via CDN or bundler) and Node.js, with zero runtime dependencies

Common Use Cases

• Encrypting form data client-side with a public key before submitting it to a server for decryption
• Signing and verifying payloads in JavaScript without a native crypto backend
• Prototyping and demoing RSA-based flows using library-generated key pairs
• Interfacing JavaScript apps with OpenSSL-generated PEM keys already used by backend services

Under The Hood

Architecture — The library centers on src/JSEncrypt.ts, a thin, stateful wrapper class exposing setPublicKey/setPrivateKey, encrypt/decrypt, sign/verify, and key-generation methods. It delegates PEM parsing and RSA key structure handling to JSEncryptRSAKey.ts, which in turn builds on a vendored copy of Tom Wu’s jsbn big-integer library plus bundled asn1js/jsrsasign helpers (in src/lib/) for ASN.1 DER/PEM decoding. This layering keeps the actual RSA math untouched from its original, widely-audited implementation while the wrapper classes only handle key format translation and API ergonomics.

Tech Stack — Written in TypeScript, compiled to a browser- and Node-compatible UMD/ESM bundle with zero runtime dependencies. It vendors jsbn, asn1js, and jsrsasign source directly rather than depending on them via npm, which keeps the published package self-contained and free of supply-chain surface area beyond the library itself.

Code Quality — The project ships Mocha-based Node tests (npm run test:mocha) plus browser-based example/test pages, and its README documents a npm test command covering both. Recent commit activity is low (health-score data shows infrequent maintenance) despite the library being mature and widely forked, which is typical for a stable, feature-complete cryptography utility that doesn’t need frequent changes once correct.

API Design — The class-based API (new JSEncrypt(), .setPublicKey(), .encrypt(), .decrypt()) requires almost no boilerplate to get started, and the README leads with copy-pasteable examples for both browser-global and Node.js/ESM usage. Method names map directly onto RSA operations (encrypt/decrypt/sign/verify) and the docs clearly separate the OpenSSL-key path (recommended) from the JS-key-generation convenience path, reducing the chance of accidental misuse for security-sensitive code.