Back to Explore

paulmillr/noble-hashes

GitHub
1 updates · last 90 days1 watchersOpen source

Last release: 1 month ago

Audited, minimal JavaScript library that implements hash functions, MACs, and KDFs, including SHA, RIPEMD, BLAKE, HMAC, HKDF, PBKDF2, scrypt, and Argon2. It is designed to be fast and tree-shakeable for small builds, with optional modules for many algorithms and a friendly wrapper over native WebCrypto. Useful for adding standard cryptographic hashing, keyed hashing, and key derivation to JS or TypeScript projects.

Project status

  • Actively maintained, with a recent upstream push on 2026-05-12 and a relatively recent version update (2.2.0 on 2026-04-11) following prior updates.
  • Update cadence appears moderate, with 2.0.0 on 2025-08-25, 2.0.1 on 2025-09-22, and 2.2.0 on 2026-04-11 (no evidence of a rapid ongoing cadence beyond these data points).

AI summary generated Today

AI-generated from public sources. May be inaccurate. Report

Recent updates

  • 2.2.0

    1 month ago

    Release 2.2.0 focuses on correctness and compatibility fixes, especially around KDF/hash edge cases (dkLen=0, blockLen=0, Argon2 progress reaching 100%) and improved handling of non-4-divisible dkLen. It also introduces significant TypeScript byte-array type adjustments to work across TS 5.6 and TS 5.9+ while improving performance (notably sha3 speed-up) and bundle/tree-shaking characteristics.

  • 2.0.1

    8 months ago

    Release 2.0.1 primarily updates package exports to improve TypeScript subpath autocompletion and includes a scrypt change that fixes an error message and speeds up inner-loop index calculation. It also adjusts module import expectations around using explicit .js subpaths. No dependency bumps affecting runtime code are shown in the diff.

    BreakingFeatures

  • 2.0.0

    9 months ago

    Release 2.0.0 is a major breaking release that switches the package to ESM-only and consolidates module entry points, including mandatory `.js` extensions for submodule imports. It also tightens runtime input validation so hashing APIs accept `Uint8Array` inputs, with significant internal refactors to improve type coverage and error messages.

    BreakingSecurity

  • 1.8.0

    4/21/2025

    Release 1.8.0 is presented as a prep step for a future v2.0, with a focus on refactoring, reducing duplicate code and package size, and adding a browser-friendly module entry with a .js extension. It also introduces a deprecation-based renaming scheme for multiple hash modules (for example, sha256/sha512/blake2b/blake2s and some legacy names now point to newer module names).

    Features

  • 1.7.2

    4/14/2025

    This release adds a new `legacy` module that includes legacy (broken) SHA1 and MD5 implementations, while keeping the old `sha1` entrypoint as an alias. It also updates utility functions to use built-in `Uint8Array` hex helpers when available and improves `randomBytes` output consistency, plus enables Node.js v24 direct TS source consumption behavior.

    Features

  • 1.7.1

    1/18/2025

    Release 1.7.1 primarily introduces Blake1 support (SHA-3 proposal) and updates documentation. The diff also shows broad internal TypeScript import cleanup (type-only imports) and many comment/documentation adjustments across existing hash/KDF modules.

    Features

  • 1.7.0

    1/3/2025

    Release 1.7.0 primarily improves developer experience by adding extensive documentation comments and switching TypeScript documentation generation to use isolatedDeclarations. It also publishes the package on JSR and removes some internal exports from src/_assert. The actual code diff shows mostly type annotation and JSDoc changes, with one clearly breaking change around internal _assert exports and a notable test-suite change.

    BreakingFeatures

  • 1.6.1

    11/24/2024

    Release 1.6.1 makes a targeted fix to argon2 initialization and adjusts package publishing to include TypeScript source maps (.d.ts.map). The code diff shows argon2 option initialization and validation were refactored, and some related error messages and test vectors were updated.

  • 1.6.0

    11/22/2024

    Release 1.6.0 focuses on better support for very large inputs (4GB+ arrays on supported platforms), hardening the experimental Argon2 implementation, and optimizing internal byte validation for speed and compatibility with parsers and minifiers. The code diff also shows a refactor of the internal assertion helpers used across hashes and KDFs.

    Features

  • 1.5.0

    9/1/2024

    Release 1.5.0 expands noble-hashes functionality for Node.js 14 compatibility, and adds/exports additional TypeScript types. It also adjusts scrypt parameter validation for broader real-world compatibility and improves the single-file build exports. Code changes indicate at least one potentially significant package.json export/bundling-related modification that is not called out in the release notes.

    Features