@hyperfrontend/cryptography/nodenode
Node.js-targeted bindings of the cryptography primitives, wired to node:crypto (webcrypto.subtle and randomBytes).
Overview
This entry point composes the runtime-agnostic core (createEncrypt, createValueCreator, hashing, key derivation, key agreement, HKDF expansion, AEAD sealing, time-based passwords) with Node.js implementations of subtle, getRandomValues, and UTF-8 encoding. Function signatures match /browser so encryption workflows can be shared across the stack: pick the adapter that matches the runtime and the rest of the code stays identical.
Usage
import { encrypt, decrypt, getTimeBasedPasswords } from '@hyperfrontend/cryptography/node'
const ciphertext = await encrypt('Sensitive data', 'secure-password')
const plaintext = await decrypt(ciphertext, 'secure-password')
// Rotating passwords on a 5-minute window, with previous/next for clock-drift tolerance
const generators = getTimeBasedPasswords(new Date(), 300_000)
const current = await generators.current()
const previous = await generators.previous()Notes
subtleresolves towebcrypto.subtle. Node.js 19+ is recommended; on 18.xwebcryptois still flagged experimental.getRandomValuesdelegates torandomBytesand throws when called with a zero byte length.- The package has zero runtime dependencies beyond
node:cryptoand a small set of internal utility libs.
API Reference§
ƒ Functions
Creates a cryptographic hash of the provided data using Node.js crypto module.
Parameters
| Name | Type | Description |
|---|---|---|
§data | string | The string data to hash |
§algorithm | HashAlgorithm | The hash algorithm to use (defaults to SHA-256)(default: 'SHA-256') |
Returns
Promise<A promise that resolves to the hexadecimal hash string
Example
Creating a hash
const hash = await createHash('secret-message')
// => '64-character hexadecimal string'Generates cryptographically secure random values using Node.js crypto module.
Parameters
| Name | Type | Description |
|---|---|---|
§byteLength | number | The number of random bytes to generate |
Returns
Uint8ArrayA Uint8Array containing the random bytes
Example
Generating random bytes
const randomBytes = getRandomValues(16)
// => Uint8Array(16) with cryptographically secure random valuesValidates whether the provided value is a valid SHA-256 hash string. Checks for exactly 64 hexadecimal characters (case-insensitive).
Parameters
| Name | Type | Description |
|---|---|---|
§hash | unknown | The value to validate as a SHA-256 hash |
Returns
booleanTrue if the value is a valid SHA-256 hash string, false otherwise
Example
Validating SHA-256 hashes
isSHA256Hash('e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855')
// => true
isSHA256Hash('invalid')
// => false◈ Interfaces
Configuration for encryption algorithm settings.
Properties
One side of an ephemeral elliptic-curve Diffie-Hellman agreement (P-256).
The private key never leaves the object: it is a non-extractable
The private key never leaves the object: it is a non-extractable
CryptoKey held in a closure and is garbage-collected with the agreement. Create one agreement per session.Properties
§
readonly publicKey:Uint8ArrayThis side's public key as the 65-byte uncompressed P-256 point, to be sent to the peerParameters shared by every password-stretching operation in the library.
Properties
Options accepted by
stretchPassword.Properties
Generators for time-based one-time passwords (TOTP).
Properties
◆ Types
Supported cryptographic hash algorithms.
type HashAlgorithm = "SHA-256" | "SHA-384" | "SHA-512"● Variables
Creates an ephemeral P-256 key agreement backed by the Node.js crypto module.
Expands input key material into a non-extractable AES-GCM-256 key with HKDF-SHA256 (Node.js implementation).
Generates a UTC time-based one-time password (TOTP) with configurable time window and offset (Node.js implementation). Uses Node.js crypto module for hash generation.
Generates time-based one-time passwords (TOTP) for current, previous, and next time windows (Node.js implementation). Useful for handling time synchronization issues by providing passwords across adjacent time windows.
Opens a sealed message with AES-GCM under a caller-supplied key and nonce (Node.js implementation).
Seals a plaintext with AES-GCM under a caller-supplied key and nonce (Node.js implementation).
Stretches a password and a salt into raw key material with PBKDF2-HMAC-SHA256 (Node.js implementation).
Frozen encryption configuration to prevent runtime tampering. Using AES-GCM as the default algorithm for authenticated encryption.
PBKDF2 parameters used by
100,000 SHA-256 iterations cost roughly 17 ms on commodity hardware, which is the intended price for one password guess and the reason password stretching belongs at session or storage boundaries rather than on a per-message path.
generateKey and stretchPassword. 100,000 SHA-256 iterations cost roughly 17 ms on commodity hardware, which is the intended price for one password guess and the reason password stretching belongs at session or storage boundaries rather than on a per-message path.