@scure/base

@scure/base is a minimal, independently audited implementation of base16, base32, base58, base64, and bech32/bech32m encoding used throughout the Bitcoin and broader crypto ecosystem. Rather than writing a large monolithic encode/decode function for each format, it builds every codec by composing small, tested primitives (alphabet, radix, checksum, chain) — meaning encode and decode logic is defined once and always stays in sync.

The library ships with variant flavors used by real protocols (base58check, base58xmr, base32crockford, base64url) and is deliberately dependency-free with pinned dev dependencies, PGP-signed commits, and transparent provenance-verified releases — properties that matter for a library embedded deep in wallet and signing code. It was originally extracted from js-ethereum-cryptography and has been formally audited by cure53.

What You Get

• Standards-compliant codecs for base16, base32, base32hex, base58, base64, base64url, and bech32/bech32m (BIP173/BIP350)
• Protocol-specific variants: base58check, base58xmr, base58xrp, base32crockford, and no-padding variants
• A composable chain()/alphabet()/radix()/checksum() primitive system so encode/decode logic can’t drift out of sync
• Independent security audit (cure53, funded by the Ethereum Foundation) plus a self-audit at v2.2.0
• Tree-shakeable, ~4KB gzipped, hybrid ESM/CommonJS build with zero runtime dependencies

Common Use Cases

• Encoding/decoding Bitcoin addresses and Lightning invoices using bech32/bech32m
• Implementing base58check address encoding for cryptocurrency wallets
• Building custom mnemonic/wordlist encoders (e.g. BIP-39 style) on top of the composable primitive chain
• General-purpose base64/base32/base16 encoding in security-sensitive TypeScript applications where auditability matters

Under The Hood

Architecture The entire library is a single TypeScript file (index.ts, ~1,400 lines) that defines a small set of composable coder primitives — alphabet(), radix(), radix2(), checksum(), join() — combined via a chain() function into full codecs; each named export (base64, base58, bech32, etc.) is just a specific chain of these primitives, so encode and decode are guaranteed to be inverses by construction rather than by two independently maintained functions. Tech Stack Zero runtime dependencies; devDependencies are limited to @noble/hashes (for base58check’s sha256 in tests), @paulmillr/jsbt for benchmarking/build tooling, fast-check for property-based test generation, and typescript/prettier, reflecting the scure family’s minimal-dependency philosophy. Code Quality Tests in test/ run against Node, Bun, and Deno runtimes and include property-based tests via fast-check plus fixture-based BIP173 test vectors; the codebase is fully typed TypeScript with strict compiler settings, and the project’s own docs call out a real historical bug (an XMR base58 variant decode error) that the chain-based design was built to prevent. API Design Every codec exposes the same encode()/decode() shape regardless of format, so switching between base32, base58, or bech32 requires no API relearning; base58check is the one deliberate exception, requiring an explicit hash function via createBase58check(sha256), which keeps the core library dependency-free while still supporting checksum-based formats.