unsecure
Cryptographic utilities on the Web Crypto API
Hashing, HMAC, HKDF, Argon2, one-time passwords, UUIDs, CSPRNG helpers, prototype-pollution sanitizers and codecs. Zero dependencies, per-module subpaths, one typed error.
// Store a password
import { argon2Hash, argon2Verify } from "unsecure/argon2";
const stored = await argon2Hash(plaintext);
const ok = await argon2Verify(stored, submitted);
// Verify a webhook
import { hmacVerify } from "unsecure/hmac";
const valid = await hmacVerify(secret, body, request.headers.get("x-signature"));
// Time-ordered identifiers
import { uuidv7 } from "unsecure/uuid";
const id = uuidv7(); // "01a076ba-1e53-7411-8518-84905f353e3d"
Features
Web Crypto, zero dependencies
Built on the Web Crypto API. No Node built-ins, no runtime dependencies, no WebAssembly. Install once, run in Node, Bun, Deno, Workers and browsers.
One module per subpath
Every module is its own entry point, so a CDN import of unsecure/uuid downloads the UUID code and nothing else. The barrel stays available for bundlers.
One error, one code
Everything the library throws is an UnsecureError carrying a machine-readable code. Verification functions never throw on untrusted input; they return false.
Correct by default
Constant-time comparison, rejection sampling instead of modulo bias, strict codecs, bounds checked at the boundary, OWASP defaults for Argon2.