npm · #4818 most downloaded on npm

@noble/ciphers

2.4.0paulmillr/noble-ciphers ↗New releases in your daily digest, changelog included.

Audited & minimal JS implementation of Salsa20, ChaCha and AES

Last release 1 months ago
27 Aug 2026
Release timing varies
gaps range from 8 days to 4 months
Nearly every release is documented
notes for 25 of 26 stable releases
4 versions withdrawn
withdrawn after publishing
3 years old
30 releases · first in 2023

Release timeline

30 releases since 2023

2023202420252026

20232026

One column per quarter.

Releases

2.4.027 Aug 20262 sources agree
ChaCha / Salsa: reject output buffers that partially overlap unread input
ChaCha / Salsa: reject output buffers that partially overlap unread input

PRG: using after clean now throws

Webcrypto: snapshot keys and params

FF1: sizing for very large domains

Full Changelog: 2.3.0...2.4.0
Open source →
Additional notes
2.4.0 Latest

Latest

Compare

Choose a tag to compare

Open source →
2.3.08 Aug 2026
AEAD strictness: passing AAD to a cipher that doesn't support it now throws AAD not supported instead of silently ignoring it. Applies to both native
Hardening

AEAD strictness: passing AAD to a cipher that doesn't support it now throws AAD not supported instead of silently ignoring it. Applies to both native ciphers and the webcrypto wrappers via a new withAAD cipher param.

CBC/ECB padding failures now surface as a generic aes: bad decrypt instead of a padding-specific message, reducing padding-oracle signal.

FF1: minLen now enforces the NIST SP 800-38G minimum of 2 in addition to radix**minlen >= 100; stricter radix encoding guards.

Correctness fixes for big-endian CPUs (polyval tag normalization, AES CTR partial-block tails).

Other minor corrections

Reduce on-disk package size: 710kb → 531kb (-179kb), by disabling source maps (they became less relevant).

Boost AES-SIV speed by 20%

Full Changelog: 2.2.0...2.3.0

Additional notes

Hardening

AEAD strictness: passing AAD to a cipher that doesn't support it now throws AAD not supported instead of silently ignoring it. Applies to both native ciphers and the WebCrypto wrappers via a new withAAD cipher parameter.
CBC/ECB padding failures now surface as a generic aes: bad decrypt instead of a padding-specific message, reducing padding-oracle signal.
FF1: minLen now enforces the NIST SP 800-38G minimum of 2 in addition to radix ** minLen >= 100; stricter radix encoding guards.
Correctness fixes for big-endian CPUs (POLYVAL tag normalization and AES-CTR partial-block tails).
Other minor corrections.
Reduce on-disk package size from 710 KB to 531 KB by disabling source maps, which have become less relevant.
Boost AES-SIV speed by 20%.

Open source →

Additional notes

2.3.0

Compare

Choose a tag to compare

Open source →

2.2.011 Apr 2026

March 2026 self-audit (all files): no major issues found

March 2026 self-audit (all files): no major issues found
- Audited for spec compliance and security
- Fix: ctr from webcrypto submodule used wrong counter wrapping
- Fix: MAC no longer corrupts oversized outputs
- Align CMAC API to other MACs
Fix all Byte Array types, to ensure proper work in both TypeScript 5.6 & TypeScript 5.9+
- TS 5.6 has Uint8Array, while TS 5.9+ made it generic Uint8Array<ArrayBuffer>
- This creates incompatibility of code between versions
- Previously, it was hard to use and constantly emitted errors similar to TS2345
- See typescript#62240 for more context
Fix compilation issues on TypeScript v6
Zeroization improvements by @ChALkeR in #67, #68
Make package Big Endian friendly. All tests pass on s390x
Improve tree-shaking, reduce bundle sizes
Add massive amounts of documentation everywhere

Full Changelog: 2.1.1...2.2.0

Open source →

Additional notes

March 2026 self-audit (all files): no major issues found.
- Audited for specification compliance and security.
- Fixed the ctr implementation from the webcrypto submodule using incorrect counter wrapping.
- Fixed MAC corrupting oversized outputs.
- Aligned the CMAC API with other MACs.
Fixed all byte-array types to work properly in both TypeScript 5.6 and TypeScript 5.9+.
- TypeScript 5.6 has Uint8Array, while TypeScript 5.9+ made it generic: Uint8Array<ArrayBuffer>.
- This created incompatibilities between TypeScript versions.
- Previously, usage was difficult and constantly emitted errors similar to TS2345.
- See TypeScript issue #62240 for more context.
Fixed compilation issues on TypeScript 6.
Zeroization improvements by @ChALkeR in #67 and #68.
Made the package big-endian friendly. All tests pass on s390x.
Improved tree-shaking and reduced bundle sizes.
Added extensive documentation throughout the codebase.

Open source →

Additional notes

2.2.0

Compare

Choose a tag to compare

Open source →

2.1.17 Dec 2025Deprecated

Deprecate old siv export in aes.js because it was an alias to gcmsiv

Implement AES-SIV by @overheadhunter in #62
- AES-SIV (RFC 5297) is different from AES-GCM-SIV (RFC 8452)
- Deprecate old siv export in aes.js because it was an alias to gcmsiv
Publish provenance statement, missed in 2.0.1 due to GitHub bugs

New Contributors

@overheadhunter made their first contribution in #62

Full Changelog: 2.0.1...2.1.0

Open source →

Additional notes

Implemented AES-SIV by @overheadhunter in #62.
- AES-SIV (RFC 5297) is different from AES-GCM-SIV (RFC 8452).
- Deprecated the old siv export in aes.js because it was an alias for gcmsiv.
Published the provenance statement that was missed in 2.0.1 due to GitHub bugs.

New Contributors

@overheadhunter made their first contribution in #62.

Open source →

Additional notes

2.1.1

Compare

Choose a tag to compare

Open source →

2.0.122 Sept 2025

Disable extension-less imports. If you've used /chacha , switch to /chacha.js now. See 2.0.0 for more details.

Disable extension-less imports. If you've used /chacha, switch to /chacha.js now. See 2.0.0 for more details.
package.json: specify exported submodules to ensure typescript autocompletion

GitHub Immutable Releases

This GH release does not include NPM & JSR attestations, until we fix bugs related to newly added GitHub Immutable Releases

Full Changelog: 2.0.0...2.0.1

Open source →

Additional notes

Disabled extensionless imports. If you used /chacha, switch to /chacha.js. See 2.0.0 for more details.
Specified exported submodules in package.json to ensure TypeScript autocompletion.

GitHub Immutable Releases

This GitHub release does not include NPM and JSR attestations due to bugs related to newly added GitHub Immutable Releases.

Open source →

Additional notes

2.0.1

Compare

Choose a tag to compare

Open source →

2.0.025 Aug 2025

The package is now ESM-only. ESM can finally be loaded from common.js on node v20.19+

High-level

The package is now ESM-only. ESM can finally be loaded from common.js on node v20.19+
- Node v20.19 is now the minimum required version
- Package imports now work correctly in bundler-less environments, such as browsers
- Reduces npm package size (traffic consumed): 118KB => 99KB
- Reduces unpacked npm size (on-disk space): 753KB => 458KB
Make bundle sizes smaller, compared to v1.x
.js extension must be used for all modules
- Old: @noble/ciphers/aes
- New: @noble/ciphers/aes.js
- This simplifies working in browsers natively without transpilers

Changes

webcrypto: move randomBytes and managedNonce to utils.js
ghash, poly1305, polyval: only allow Uint8Array as hash inputs, prohibit string
utils: new abytes; remove ahash, toBytes
Remove modules _assert (use utils), _micro and crypto (use webcrypto)
Upgrade typescript compilation env to ts5.9 and es2022
Massively improve error messages, make them more descriptive

Full Changelog: 1.3.0...2.0.0

Open source →

Additional notes

High-level changes

The package is now ESM-only. ESM can be loaded from CommonJS on Node.js 20.19+.
- Node.js 20.19 is now the minimum required version.
- Package imports now work correctly in bundlerless environments, such as browsers.
- Reduced NPM package size from 118 KB to 99 KB.
- Reduced unpacked NPM size from 753 KB to 458 KB.
Made bundle sizes smaller compared to v1.x.
The .js extension must be used for all modules.
- Old: @noble/ciphers/aes
- New: @noble/ciphers/aes.js
- This simplifies native browser usage without transpilers.

Changes

Moved randomBytes and managedNonce from WebCrypto to utils.js.
Restricted GHASH, Poly1305, and POLYVAL hash inputs to Uint8Array; strings are prohibited.
Added abytes to utils and removed ahash and toBytes.
Removed the _assert module (use utils), _micro, and crypto (use webcrypto).
Upgraded the TypeScript compilation environment to TypeScript 5.9 and ES2022.
Made error messages substantially more descriptive.

Open source →

Additional notes

2.0.0

Compare

Choose a tag to compare

Open source →

2.0.0-beta.417 Aug 2025pre-releasewithdrawn: beta

Nothing published for this version

2.0.0-beta.330 Jul 2025pre-releasewithdrawn: beta

Nothing published for this version

2.0.0-beta.215 Jul 2025pre-releasewithdrawn: beta

Nothing published for this version

2.0.0-beta.129 May 2025pre-releasewithdrawn: beta

Nothing published for this version

1.3.024 Apr 2025

Modules are now available with .js extension

Modules are now available with .js extension
- Old: @noble/ciphers/chacha
- New: @noble/ciphers/chacha.js
- Old path is still available
- This simplifies working in browsers natively without transpilers

utils: use built-in Uint8Array toHex / fromHex when available. Gives 13x speed-up on 256b arrays, 20x speed-up on 32kb arrays
utils.randomBytes: ensure same return type Uint8Array in old nodejs
Move _assert into utils
Rename siv to gcmsiv
Standalone build files are now attested in CI. Check out README for verification guide
Typescript source can now be used without compilation in node.js v24, due to erasableSyntaxOnly

Full Changelog: 1.2.1...1.3.0

Open source →

Additional notes

Modules are now available with a .js extension.
- Old: @noble/ciphers/chacha
- New: @noble/ciphers/chacha.js
- The old path remains available.
- This simplifies native browser usage without transpilers.
Updated utils to use built-in Uint8Array toHex and fromHex when available, providing a 13× speed-up on 256-byte arrays and a 20× speed-up on 32 KB arrays.
Ensured utils.randomBytes has the same Uint8Array return type in older Node.js versions.
Moved _assert into utils.
Renamed siv to gcmsiv.
Standalone build files are now attested in CI. See the README for the verification guide.
TypeScript source can now be used without compilation in Node.js 24 due to erasableSyntaxOnly.

Open source →

Additional notes

1.3.0

Compare

Choose a tag to compare

Open source →

1.2.118 Jan 2025

Use typescript verbatimModuleSyntax to support future node.js type stripping

Use typescript verbatimModuleSyntax to support future node.js type stripping

Full Changelog: 1.2.0...1.2.1

Open source →

Additional notes

Enabled TypeScript's verbatimModuleSyntax to support future Node.js type stripping.

Open source →

Additional notes

1.2.1

Compare

Choose a tag to compare

Open source →

1.2.03 Jan 2025

The package is now available on JSR .

The package is now available on JSR.
Use isolatedDeclarations typescript option, which massively simplifies documentation auto-gen, and more
- Check out JSR page for one example
Add tons of comments everywhere to improve autocompletion, LLM code gen, and basic code understanding.
Remove some exports from internal _assert

Full Changelog: 1.1.3...1.2.0

Open source →

Additional notes

The package is now available on JSR.
Enabled TypeScript's isolatedDeclarations option, which substantially simplifies automatic documentation generation and more.
- See the JSR page for an example.
Added extensive comments throughout the codebase to improve autocompletion, LLM code generation, and general code understanding.
Removed some exports from the internal _assert module.

Open source →

Additional notes

1.2.0

Compare

Choose a tag to compare

Open source →

1.1.330 Nov 2024

Harden input / output buffer checks

Harden input / output buffer checks
- Ensure all ciphers prohibit overlaps
- Ensure salsapoly supports overlapping input / output
- Ensure chachapoly also supports it. This brings v1.0.0 behavior

Full Changelog: 1.1.2...1.1.3

Open source →

Additional notes

Hardened input and output buffer checks.
- Ensured all ciphers prohibit overlaps.
- Ensured SalsaPoly supports overlapping input and output.
- Ensured ChaChaPoly supports overlapping input and output, restoring the 1.0.0 behavior.

Open source →

Additional notes

1.1.3

Compare

Choose a tag to compare

Open source →

1.1.228 Nov 2024

Prohibit input and output overlaps

Prohibit input and output overlaps
- Reusing same buffer still works when indexes do not overlap with each other

Full Changelog: https://github.com/paulmillr/noble-ciphers/compare/1.1.1...1.1.2

Open source →

Additional notes

Prohibited input and output overlaps.
- Reusing the same buffer still works when indexes do not overlap.

Open source →

Additional notes

1.1.2

Compare

Choose a tag to compare

Open source →

1.1.126 Nov 2024

Fix usage with unaligned output. Closes gh-47

Fix usage with unaligned output. Closes gh-47
Ensure output is zeroized before usage

Full Changelog: https://github.com/paulmillr/noble-ciphers/compare/1.1.0...1.1.1

Open source →

Additional notes

Fixed usage with unaligned output. Closes #47.
Ensured output is zeroized before use.

Open source →

1.1.023 Nov 2024

Improve input validation logic: move key, nonce & input validation into wrapCipher

Improve input validation logic: move key, nonce & input validation into wrapCipher
- Explicitly prohibit calling cipher more than once
Speed-up byte array checks
Decrease bundle size, improve tree-shaking

New Contributors

@ChALkeR made their first contribution in https://github.com/paulmillr/noble-ciphers/pull/44

Full Changelog: https://github.com/paulmillr/noble-ciphers/compare/1.0.0...1.1.0

Open source →

Additional notes

Improved input validation by moving key, nonce, and input validation into wrapCipher.
- Explicitly prohibited calling a cipher more than once.
Sped up byte-array checks.
Decreased bundle size and improved tree-shaking.

New Contributors

@ChALkeR made their first contribution in #44.

Open source →

1.0.012 Sept 2024

Prohibit AES-GCM nonces smaller than 8 bytes

First audited version
Prohibit AES-GCM nonces smaller than 8 bytes
Hide unnecessary data exposure in AES errors
Improve FF1 type checks
Add support for node.js v14

Full Changelog: https://github.com/paulmillr/noble-ciphers/compare/0.6.0...1.0.0

Open source →

Additional notes

First audited version.
Prohibited AES-GCM nonces smaller than 8 bytes.
Hid unnecessary data exposure in AES errors.
Improved FF1 type checks.
Added support for Node.js 14.

Open source →

0.6.05 Aug 2024

Implement AESKW, AESKWP from RFC 3394 / RFC 5649

Implement AESKW, AESKWP from RFC 3394 / RFC 5649
Add support for unaligned byte arrays
Improve typescript compatibility with different module resolutions

Full Changelog: https://github.com/paulmillr/noble-ciphers/compare/0.5.3...0.6.0

Open source →

0.5.36 May 2024

arx: Remove hard-dependency on TextEncoder

arx: Remove hard-dependency on TextEncoder
arx: Export sigma variable for hsalsa
Include default value for AAD argument in webcrypto aes-gcm algorithm

New Contributors

@antonioconselheiro made their first contribution in https://github.com/paulmillr/noble-ciphers/pull/34

Full Changelog: https://github.com/paulmillr/noble-ciphers/compare/0.5.2...0.5.3

Open source →

0.5.225 Mar 2024

@ocavue made their first contribution in https://github.com/paulmillr/noble-ciphers/pull/27

Add AES-CFB
Adjust tsconfig

New Contributors

@ocavue made their first contribution in https://github.com/paulmillr/noble-ciphers/pull/27

Full Changelog: https://github.com/paulmillr/noble-ciphers/compare/0.5.1...0.5.2

Open source →

0.5.19 Feb 2024

@mirceanis made their first contribution in https://github.com/paulmillr/noble-ciphers/pull/25

Import bugfix

New Contributors

@mirceanis made their first contribution in https://github.com/paulmillr/noble-ciphers/pull/25

Full Changelog: https://github.com/paulmillr/noble-ciphers/compare/0.5.0...0.5.1

Open source →

0.5.09 Feb 2024

Merge all webcrypto modules into one @noble/ciphers/webcrypto

Merge all webcrypto modules into one @noble/ciphers/webcrypto
Improve type check for chacha options, to ensure proper work in next.js-like environments
Improve tree-shaking

Full Changelog: https://github.com/paulmillr/noble-ciphers/compare/0.4.1...0.5.0

Open source →

0.4.111 Dec 2023

AES: fix ctr mode nonce mutation

AES: fix ctr mode nonce mutation
utils improvements
- isBytes: improve reliability in bad environments such as jsdom
- concatBytes: improve safety by early-checking the type
- equalBytes: make constant-time
Bump typescript version used to build the package to 5.3.2

Full Changelog: https://github.com/paulmillr/noble-ciphers/compare/0.4.0...0.4.1

Open source →

0.4.019 Oct 2023

ECB, CBC, CTR, GCM, SIV modes are available

Implement AES in pure js
- ECB, CBC, CTR, GCM, SIV modes are available
- You can choose between pure js @noble/ciphers/aes and webcrypto @noble/ciphers/webcrypto/aes
- Useful for platforms such as React Native
AES API is now gcm(key, nonce). AES mode length is automatically selected based on key length
Speed-up and refactor salsa and chacha
webcrypto/aes: export overridable cryptoSubtleUtils
utils: speed-up hexToBytes 6x

Full Changelog: https://github.com/paulmillr/noble-ciphers/compare/0.3.0...0.4.0

Open source →

0.3.031 Aug 2023

Add webcrypto aes-gcm opitonal aad by @kigawas in https://github.com/paulmillr/noble-ciphers/pull/6

Add webcrypto aes-gcm opitonal aad by @kigawas in https://github.com/paulmillr/noble-ciphers/pull/6
Remove @noble/ciphers/simple
Fix offsetted key and nonce reported in #7

New Contributors

@kigawas made their first contribution in https://github.com/paulmillr/noble-ciphers/pull/6

Full Changelog: https://github.com/paulmillr/noble-ciphers/compare/0.2.0...0.3.0

Open source →

0.2.031 Jul 2023

Add @noble/ciphers/simple hassle-free module

Add @noble/ciphers/simple hassle-free module
Add output optional param to AEADs, to be able to reduce allocations
Improve tree-shaking
Rename:
- salsa20_poly1305 to salsa20poly1305
- chacha20_poly1305 to chacha20poly1305
- xchacha20_poly1305 to xchacha20poly1305

Full Changelog: https://github.com/paulmillr/noble-ciphers/compare/0.1.4...0.2.0

Open source →

0.1.415 Jul 2023

Fix byte offset bug https://github.com/paulmillr/noble-ciphers/pull/2

Full Changelog: https://github.com/paulmillr/noble-ciphers/compare/0.1.3...0.1.4

Open source →

0.1.329 Jun 2023

A few build improvements Full Changelog: https://github.com/paulmillr/noble-ciphers/compare/0.1.2...0.1.3

A few build improvements

Full Changelog: https://github.com/paulmillr/noble-ciphers/compare/0.1.2...0.1.3

Open source →

0.1.228 Jun 2023

Nothing published for this version

Your coding agent can read these notes before it upgrades. Set up the MCP server →