Introduction
unsecure hashes passwords, verifies signatures and two-factor codes, generates tokens and IDs, and parses untrusted JSON, on the Web Crypto API with no dependencies.
unsecure is a TypeScript toolbox for the security chores that show up in almost every app. It stores passwords, checks webhook signatures and two-factor codes, makes tokens and IDs, and reads JSON you didn't write. It's built on the Web Crypto API, so the same code runs in Node.js, Bun, Deno, Cloudflare Workers and browsers. Each module has its own entry point, and the package pulls in no other dependencies. If hashing, signing and password storage still blur together for you, start with Four things that look like hashing.
#What you can do with it
Find the job you have in front of you in the first column, and the row tells you where to go:
| You want to | Family | Import from |
|---|---|---|
| Fingerprint data, or sign a message with a shared secret | Hashing and MAC | unsecure/hash, unsecure/hmac |
| Turn one secret into several keys | Key derivation | unsecure/hkdf |
| Store passwords and check them at login | Password hashing | unsecure/argon2 |
| Add authenticator-app codes for two-factor login | One-time passwords | unsecure/otp |
| Generate tokens and compare secrets | Secrets | unsecure/generate, unsecure/compare, unsecure/entropy |
| Draw random numbers, bytes or shuffles | Random | unsecure/random |
| Give records unique IDs that sort by creation time | UUID | unsecure/uuid |
| Make loot drops and prize draws feel fair | Odds | unsecure/odds |
| Read JSON without letting it change your objects' prototypes | Sanitize | unsecure/sanitize |
| Write bytes as hex, base64 or base32, and read them back | Codecs | unsecure/utils |
Tell one failure from another in a catch | Errors | unsecure/errors |
#Two rules that hold in every module
A verify function treats a bad value from a client as a wrong answer and returns false; it only throws when your own setup is wrong. Trusted and untrusted input lists those functions and the one exception. Every error the library throws is an UnsecureError with a code you can branch on, all listed in Errors.
#What it doesn't do
A few jobs live elsewhere: the library doesn't encrypt data, issue JSON Web Tokens or store state for you. What this library is not points you to what does.
#Where to go next
If you're new here, the first three pages in order take you to working code, and the last one helps if you're upgrading from 0.2: