@hyperfrontend/cryptography/browserbrowser
Browser-targeted bindings of the cryptography primitives, wired to the Web Crypto API on globalThis.crypto.
Overview
This entry point composes the runtime-agnostic core (createEncrypt, createValueCreator, hashing, key derivation, key agreement, HKDF expansion, AEAD sealing, time-based passwords) with browser implementations of subtle, getRandomValues, and UTF-8 encoding. The exported function signatures are identical to /node, so application code that imports from @hyperfrontend/cryptography/browser can be ported between runtimes without changes.
Usage
import { encrypt, decrypt, createVault, createHash } from '@hyperfrontend/cryptography/browser'
const ciphertext = await encrypt('top-secret', 'user-password')
const plaintext = await decrypt(ciphertext, 'user-password')
const vault = createVault(true) // singleUse
await vault.write('token', 'sk-live-...')
const password = vault.getPassword()
const token = await vault.read('token', password) // vault closes after read
const digest = await createHash('payload') // 64-char hex SHA-256Notes
subtleresolves toglobalThis.crypto.subtle; a secure context (HTTPS or localhost) is required.getRandomValuesis backed bycrypto.getRandomValuesand throws when called with a zero byte length.- Algorithm choices (AES-GCM, PBKDF2 with 100,000 iterations, SHA-256 default) live in the shared core and cannot be overridden per call.
API Reference§
ƒ Functions
Creates a cryptographic hash of the provided data using Web Crypto API (browser implementation).
Parameters
| Name | Type | Description |
|---|---|---|
§data | string | The string data to hash |
§algorithm | HashAlgorithm | The hash algorithm to use (defaults to SHA-256)(default: 'SHA-256') |
Returns
Promise<A promise that resolves to the hexadecimal hash string
Example
Creating a hash
const hash = await createHash('secret-message')
// => '64-character hexadecimal string'Generates cryptographically secure random values using Web Crypto API (browser implementation).
Parameters
| Name | Type | Description |
|---|---|---|
§byteLength | number | The number of random bytes to generate |
Returns
Uint8ArrayA Uint8Array containing the random bytes
Example
Generating random bytes
const randomBytes = getRandomValues(16)
// => Uint8Array(16) with cryptographically secure random valuesValidates whether the provided value is a valid SHA-256 hash string. Checks for exactly 64 hexadecimal characters (case-insensitive).
Parameters
| Name | Type | Description |
|---|---|---|
§hash | unknown | The value to validate as a SHA-256 hash |
Returns
booleanTrue if the value is a valid SHA-256 hash string, false otherwise
Example
Validating SHA-256 hashes
isSHA256Hash('e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855')
// => true
isSHA256Hash('invalid')
// => false◈ Interfaces
Configuration for encryption algorithm settings.
Properties
One side of an ephemeral elliptic-curve Diffie-Hellman agreement (P-256).
The private key never leaves the object: it is a non-extractable
The private key never leaves the object: it is a non-extractable
CryptoKey held in a closure and is garbage-collected with the agreement. Create one agreement per session.Properties
§
readonly publicKey:Uint8ArrayThis side's public key as the 65-byte uncompressed P-256 point, to be sent to the peerParameters shared by every password-stretching operation in the library.
Properties
Options accepted by
stretchPassword.Properties
Generators for time-based one-time passwords (TOTP).
Properties
◆ Types
Supported cryptographic hash algorithms.
type HashAlgorithm = "SHA-256" | "SHA-384" | "SHA-512"● Variables
Creates an ephemeral P-256 key agreement backed by the Web Crypto API.
Frozen encryption configuration to prevent runtime tampering. Using AES-GCM as the default algorithm for authenticated encryption.
Expands input key material into a non-extractable AES-GCM-256 key with HKDF-SHA256 (browser implementation).
Generates a UTC time-based one-time password (TOTP) with configurable time window and offset (browser implementation). Uses Web Crypto API for hash generation.
Generates time-based one-time passwords (TOTP) for current, previous, and next time windows (browser implementation). Useful for handling time synchronization issues by providing passwords across adjacent time windows.
PBKDF2 parameters used by
100,000 SHA-256 iterations cost roughly 17 ms on commodity hardware, which is the intended price for one password guess and the reason password stretching belongs at session or storage boundaries rather than on a per-message path.
generateKey and stretchPassword. 100,000 SHA-256 iterations cost roughly 17 ms on commodity hardware, which is the intended price for one password guess and the reason password stretching belongs at session or storage boundaries rather than on a per-message path.
Opens a sealed message with AES-GCM under a caller-supplied key and nonce (browser implementation).
Seals a plaintext with AES-GCM under a caller-supplied key and nonce (browser implementation).
Stretches a password and a salt into raw key material with PBKDF2-HMAC-SHA256 (browser implementation).