@linagora/twake-crypto-utils

Cryptography helpers built on the Web Crypto API. Runs in Node, Bun, Deno, and browsers without polyfills or third-party dependencies.

Install

npm install @linagora/twake-crypto-utils

Requires Node 20+ or any runtime that exposes globalThis.crypto.subtle.

Quick start

import { hmacSha256, verifyHmacSha256 } from '@linagora/twake-crypto-utils';

const digest = await hmacSha256(payload, process.env.SECRET!);
const ok = await verifyHmacSha256(payload, process.env.SECRET!, digest);

import { deriveAesGcmKey, encryptAesGcm, decryptAesGcm } from '@linagora/twake-crypto-utils';

const key = await deriveAesGcmKey(process.env.SESSION_SECRET!); // once at startup
const cookie = await encryptAesGcm(JSON.stringify(session), key);
const json = await decryptAesGcm(cookie, key); // null on tamper

Full API reference: docs/.

What's available

Capability	Helpers
Password hashing	pbkdf2Hash; generateScryptHash (via /node)
Symmetric encryption	makeEncryptionKey, decryptEncryptionKey (AES-CBC, Bitwarden cipher format), encryptAesGcm, decryptAesGcm
Asymmetric	generateKeyPair, decryptKeyPairPrivateKey (RSA-OAEP 2048)
MAC + hash	hmacSha256, verifyHmacSha256, createSha256Hash, hkdfExpand, timingSafeStringEqual
Random	generateRandomToken, generateRandomString
JWT	decodeJwtPayload, getJwtStringProperty (decode-only)
Encoding	arrayBufferToBase64, base64UrlEncode, hexEncode, ...

Web Crypto-backed helpers are async. Random, encoding, password regex, and timingSafeStringEqual are sync.

Two entries

• @linagora/twake-crypto-utils runs anywhere with the Web Crypto API.
• @linagora/twake-crypto-utils/node carries scrypt only (no Web Crypto equivalent exists). Importing from browser code fails at build time, by design.

License

MIT