node:crypto module methods and properties

crypto.argon2(algorithm, parameters, callback): void

Provides an asynchronous Argon2 implementation. Argon2 is a password-based key derivation function that is designed to be expensive computationally and memory-wise in order to make brute-force attacks unrewarding.

The nonce should be as unique as possible. It is recommended that a nonce is random and at least 16 bytes long. See NIST SP 800-132 for details.

When passing strings for message, nonce, secret or associatedData, please consider caveats when using strings as inputs to cryptographic APIs.

The callback function is called with two arguments: err and derivedKey. err is an exception object when key derivation fails, otherwise err is null. derivedKey is passed to the callback as a Buffer.

An exception is thrown when any of the input arguments specify invalid values or types.

const { argon2, randomBytes } = await import('node:crypto');

const parameters = {
  message: 'password',
  nonce: randomBytes(16),
  parallelism: 4,
  tagLength: 64,
  memory: 65536,
  passes: 3,
};

argon2('argon2id', parameters, (err, derivedKey) => {
  if (err) throw err;
  console.log(derivedKey.toString('hex'));  // 'af91dad...9520f15'
});

const { argon2, randomBytes } = require('node:crypto');

const parameters = {
  message: 'password',
  nonce: randomBytes(16),
  parallelism: 4,
  tagLength: 64,
  memory: 65536,
  passes: 3,
};

argon2('argon2id', parameters, (err, derivedKey) => {
  if (err) throw err;
  console.log(derivedKey.toString('hex'));  // 'af91dad...9520f15'
});

crypto.argon2Sync(algorithm, parameters): Buffer

Provides a synchronous Argon2 implementation. Argon2 is a password-based key derivation function that is designed to be expensive computationally and memory-wise in order to make brute-force attacks unrewarding.

The nonce should be as unique as possible. It is recommended that a nonce is random and at least 16 bytes long. See NIST SP 800-132 for details.

When passing strings for message, nonce, secret or associatedData, please consider caveats when using strings as inputs to cryptographic APIs.

An exception is thrown when key derivation fails, otherwise the derived key is returned as a Buffer.

An exception is thrown when any of the input arguments specify invalid values or types.

const { argon2Sync, randomBytes } = await import('node:crypto');

const parameters = {
  message: 'password',
  nonce: randomBytes(16),
  parallelism: 4,
  tagLength: 64,
  memory: 65536,
  passes: 3,
};

const derivedKey = argon2Sync('argon2id', parameters);
console.log(derivedKey.toString('hex'));  // 'af91dad...9520f15'

const { argon2Sync, randomBytes } = require('node:crypto');

const parameters = {
  message: 'password',
  nonce: randomBytes(16),
  parallelism: 4,
  tagLength: 64,
  memory: 65536,
  passes: 3,
};

const derivedKey = argon2Sync('argon2id', parameters);
console.log(derivedKey.toString('hex'));  // 'af91dad...9520f15'

crypto.checkPrime(candidate, options?, callback): void

Checks the primality of the candidate.

crypto.checkPrimeSync(candidate, options?): boolean

Checks the primality of the candidate.

An object containing commonly used constants for crypto and security related operations. The specific constants currently defined are described in Crypto constants.

crypto.createCipheriv(algorithm, key, iv, options?): Cipheriv

Creates and returns a Cipheriv object, with the given algorithm, key and initialization vector (iv).

The options argument controls cipher-specific settings and stream behavior. It is optional except when a cipher in CCM or OCB mode (e.g. 'aes-128-ccm') is used. In that case, the authTagLength option is required and specifies the length of the authentication tag in bytes, see CCM mode. In GCM mode, the authTagLength option is not required but can be used to set the length of the authentication tag that will be returned by getAuthTag() and defaults to 16 bytes. For SIV, GCM-SIV, and chacha20-poly1305, the authTagLength option defaults to 16 bytes. SIV and GCM-SIV only support 16-byte authentication tags.

The ctsMode and xtsStandard options configure parameters exposed by OpenSSL providers. They are available only with OpenSSL 3.0 or later and a provider that supports the corresponding parameter. ctsMode applies only to CBC-CTS ciphers, and xtsStandard applies only to sm4-xts. Supplying either option for an available cipher implementation that does not support it throws an ERR_CRYPTO_UNSUPPORTED_OPERATION error. See CBC-CTS mode and XTS mode for details.

The available algorithms depend on OpenSSL. crypto.getCiphers() lists the algorithms exposed by Node.js. On recent OpenSSL releases, openssl list -cipher-algorithms displays the algorithms available to OpenSSL, which can include algorithms that Node.js does not expose.

The key is the raw key used by the algorithm and iv is an initialization vector. Each may be a string, ArrayBuffer, Buffer, TypedArray, or DataView. A string key is decoded using options.encoding, which defaults to 'utf8'; a string iv is always decoded as UTF-8. The key may optionally be a KeyObject of type secret. If the cipher does not need an initialization vector, iv may be null.

When passing strings for key or iv, please consider caveats when using strings as inputs to cryptographic APIs.

Initialization vector requirements depend on the algorithm. For some algorithms, an IV must be unpredictable and unique; for others, uniqueness alone is sufficient, a fixed value is required, or no IV is used. Follow the requirements for the selected algorithm. IVs typically do not have to be secret and can be transmitted with the ciphertext.

crypto.createDecipheriv(algorithm, key, iv, options?): Decipheriv

Creates and returns a Decipheriv object that uses the given algorithm, key and initialization vector (iv).

The options argument controls cipher-specific settings and stream behavior. It is optional except when a cipher in CCM or OCB mode (e.g. 'aes-128-ccm') is used. In that case, the authTagLength option is required and specifies the length of the authentication tag in bytes, see CCM mode. For GCM and chacha20-poly1305, the authTagLength option defaults to 16 bytes and must be set if a different length is used. For SIV and GCM-SIV, the authTagLength option defaults to 16 bytes and only 16-byte authentication tags are supported.

The ctsMode and xtsStandard options configure parameters exposed by OpenSSL providers. They are available only with OpenSSL 3.0 or later and a provider that supports the corresponding parameter. ctsMode applies only to CBC-CTS ciphers, and xtsStandard applies only to sm4-xts. Supplying either option for an available cipher implementation that does not support it throws an ERR_CRYPTO_UNSUPPORTED_OPERATION error. See CBC-CTS mode and XTS mode for details.

The available algorithms depend on OpenSSL. crypto.getCiphers() lists the algorithms exposed by Node.js. On recent OpenSSL releases, openssl list -cipher-algorithms displays the algorithms available to OpenSSL, which can include algorithms that Node.js does not expose.

The key is the raw key used by the algorithm and iv is an initialization vector. Each may be a string, ArrayBuffer, Buffer, TypedArray, or DataView. A string key is decoded using options.encoding, which defaults to 'utf8'; a string iv is always decoded as UTF-8. The key may optionally be a KeyObject of type secret. If the cipher does not need an initialization vector, iv may be null.

When passing strings for key or iv, please consider caveats when using strings as inputs to cryptographic APIs.

Initialization vector requirements depend on the algorithm. For some algorithms, an IV must be unpredictable and unique; for others, uniqueness alone is sufficient, a fixed value is required, or no IV is used. Follow the requirements for the selected algorithm. IVs typically do not have to be secret and can be transmitted with the ciphertext.

crypto.createDiffieHellman(prime, primeEncoding?, generator?, generatorEncoding?): DiffieHellman

Creates a DiffieHellman key exchange object using the supplied prime and an optional specific generator.

The generator argument can be a number, string, or Buffer. If generator is not specified, the value 2 is used.

If primeEncoding is specified, prime is expected to be a string; otherwise a Buffer, TypedArray, or DataView is expected.

If generatorEncoding is specified, generator is expected to be a string; otherwise a number, Buffer, TypedArray, or DataView is expected.

crypto.createDiffieHellman(primeLength, generator?): DiffieHellman

Creates a DiffieHellman key exchange object and generates a prime of primeLength bits using an optional specific numeric generator. If generator is not specified, the value 2 is used.

crypto.createDiffieHellmanGroup(name): DiffieHellmanGroup

An alias for crypto.getDiffieHellman()

crypto.createECDH(curveName): ECDH

Creates an Elliptic Curve Diffie-Hellman (ECDH) key exchange object using a predefined curve specified by the curveName string. Use crypto.getCurves() to obtain a list of available curve names. On recent OpenSSL releases, openssl ecparam -list_curves will also display the name and description of each available elliptic curve.

crypto.createHash(algorithm, options?): Hash

Creates and returns a Hash object that can be used to generate hash digests using the given algorithm. Optional options argument controls stream behavior. For XOF hash functions such as 'shake256', the outputLength option can be used to specify the desired output length in bytes.

The functionName and customization options apply only to cSHAKE-128 and cSHAKE-256. They are supported only when Node.js is built with OpenSSL 4.0 or later and the selected provider supports the corresponding digest parameters. Strings are encoded as UTF-8, and neither strings nor byte values may contain NUL bytes. Both options default to an empty byte string. For OpenSSL's built-in providers, functionName is case-sensitive and must be '', 'TupleHash', 'ParallelHash', or 'KMAC'. Other providers can impose different restrictions. With both options empty, cSHAKE produces the same output as the corresponding SHAKE function for the same output length. cshake-128 and cshake-256 default to output lengths of 32 and 64 bytes, respectively.

When the data is small (< 5MB) and readily available, crypto.hash() is usually faster.

The available algorithms depend on the version and configuration of OpenSSL on the platform. Examples are 'sha256' and 'sha512'. Use crypto.getHashes() to obtain the list of hash algorithms available to the Node.js process.

Example: generating the sha256 sum of a file

import {
  createReadStream,
} from 'node:fs';
import { argv } from 'node:process';
const {
  createHash,
} = await import('node:crypto');

const filename = argv[2];

const hash = createHash('sha256');

const input = createReadStream(filename);
input.on('readable', () => {
  // Only one element is going to be produced by the
  // hash stream.
  const data = input.read();
  if (data)
    hash.update(data);
  else {
    console.log(`${hash.digest('hex')} ${filename}`);
  }
});

const {
  createReadStream,
} = require('node:fs');
const {
  createHash,
} = require('node:crypto');
const { argv } = require('node:process');

const filename = argv[2];

const hash = createHash('sha256');

const input = createReadStream(filename);
input.on('readable', () => {
  // Only one element is going to be produced by the
  // hash stream.
  const data = input.read();
  if (data)
    hash.update(data);
  else {
    console.log(`${hash.digest('hex')} ${filename}`);
  }
});

crypto.createHmac(algorithm, key, options?): Hmac

Creates and returns an Hmac object that uses the given algorithm and key. Optional options argument controls stream behavior.

The available algorithms depend on the version and configuration of OpenSSL on the platform. Examples are 'sha256' and 'sha512'. crypto.getHashes() lists algorithms available to the hashing APIs, but HMAC imposes additional restrictions, so not every listed algorithm is suitable.

The key is the HMAC key used to generate the cryptographic HMAC hash. If it is a KeyObject, its type must be secret. If it is a string, please consider caveats when using strings as inputs to cryptographic APIs. If it was obtained from a cryptographically secure source of entropy, such as crypto.randomBytes() or crypto.generateKey(), its length should not exceed the block size of algorithm (e.g., 512 bits for SHA-256).

Example: generating the sha256 HMAC of a file

import {
  createReadStream,
} from 'node:fs';
import { argv } from 'node:process';
const {
  createHmac,
} = await import('node:crypto');

const filename = argv[2];

const hmac = createHmac('sha256', 'a secret');

const input = createReadStream(filename);
input.on('readable', () => {
  // Only one element is going to be produced by the
  // hash stream.
  const data = input.read();
  if (data)
    hmac.update(data);
  else {
    console.log(`${hmac.digest('hex')} ${filename}`);
  }
});

const {
  createReadStream,
} = require('node:fs');
const {
  createHmac,
} = require('node:crypto');
const { argv } = require('node:process');

const filename = argv[2];

const hmac = createHmac('sha256', 'a secret');

const input = createReadStream(filename);
input.on('readable', () => {
  // Only one element is going to be produced by the
  // hash stream.
  const data = input.read();
  if (data)
    hmac.update(data);
  else {
    console.log(`${hmac.digest('hex')} ${filename}`);
  }
});

crypto.createMac(algorithm, key, options?): Mac

algorithm must be a non-empty provider MAC name. The MAC-specific properties listed above are extensions to the standard stream.transform options and are passed only when the selected provider implementation advertises the corresponding parameter with the expected type. A supplied MAC-specific option that the selected implementation does not support causes an error.

The following table summarizes the MAC-specific options accepted by MAC implementations in OpenSSL's built-in providers. The key argument is required for every MAC. The table lists only MAC-specific options; standard stream.transform options remain available for every family.

outputLength configures the output size of the provider MAC. It is never implemented by computing a longer tag and truncating it. A value of 0 is passed to the provider and is accepted only when that provider can initialize and finalize the MAC with a zero-byte output. When outputLength is omitted, the provider's default output size is used and must be nonzero.

The key must contain bytes or be a KeyObject of type secret. Key length and other key requirements are determined by the selected provider implementation.

Available algorithms and their accepted parameters depend on the OpenSSL version, loaded providers, and active default property query. Use crypto.getMacs() to list fetchable MAC names. A listed name can still require options or a key with provider-specific properties.

crypto.createPrivateKey(key): KeyObject

Creates and returns a new key object containing a private key. If key is a string or Buffer, format is assumed to be 'pem'; otherwise, key must be an object with the properties described above.

If the private key is encrypted, a passphrase must be specified. The length of the passphrase is limited to 1024 bytes.

If key is a URL (or an object whose key is a URL), the private key is loaded through an OpenSSL STORE loader. The URL is passed to OpenSSL as a URI, for example a file: URI or a provider-backed scheme such as pkcs11:. When the Permission Model is enabled, --allow-openssl-store is required.

Warning: A URI scheme does not pin an OpenSSL STORE loader or prove where the returned key came from. Node.js forwards the URI to OpenSSL, which chooses loaders according to its version and configuration. For example, OpenSSL may offer an opaque URI such as pkcs11:object=... (one without // after the scheme) to its file loader before trying the pkcs11 loader. If the complete URI is a valid local path and that file exists, it may be loaded instead. Node.js does not verify which loader supplied the key. Do not rely on a provider-specific URI scheme as proof that a key came from that provider or from a hardware device.

Configured OpenSSL STORE loaders have broad authority and may access files, devices, tokens, or the network. Access performed by a loader is not constrained by the fs.read, fs.write, or net permission scopes.

When a URL is used, format, type, asymmetricKeyType, and namedCurve are ignored even when those options would otherwise depend on each other, such as type with format: 'der' or namedCurve with asymmetricKeyType: 'ec'. The input is passed to the STORE loader as a URI, not handled as PEM, DER, JWK, or raw key material. passphrase is still used as the optional PIN/passphrase passed to the loader, and encoding applies if that passphrase is a string.

Use passphrase instead of embedding credentials in the URI passed to the STORE loader. Node.js redacts the URI from its own permission-denial resource and diagnostics. Errors reported by OpenSSL or a provider after loading begins may include the URI.

When properties is specified with a URL key, it is passed to OpenSSL as the property query for selecting the STORE loader. It is not appended to the URL and is distinct from provider-specific URI parameters.

crypto.createPublicKey(key): KeyObject

Creates and returns a new key object containing a public key. If key is a string or Buffer, format is assumed to be 'pem'; if key is a KeyObject with type 'private', the public key is derived from the given private key; otherwise, key must be an object with the properties described above.

If the format is 'pem', the 'key' may also be an X.509 certificate.

Because public keys can be derived from private keys, a private key may be passed instead of a public key. In that case, this function behaves as if crypto.createPrivateKey() had been called, except that the type of the returned KeyObject will be 'public' and that the private key cannot be extracted from the returned KeyObject. Similarly, if a KeyObject with type 'private' is given, a new KeyObject with type 'public' will be returned and it will be impossible to extract the private key from the returned object.

A store-backed private key can be used as a public key by first loading it with crypto.createPrivateKey(); a URL cannot be passed to crypto.createPublicKey() directly.

crypto.createSecretKey(key, encoding?): KeyObject

Creates and returns a new key object containing a secret key for symmetric encryption or Hmac.

crypto.createSign(algorithm, options?): Sign

Creates and returns a Sign object that uses the given algorithm. Use crypto.getHashes() to obtain the names available to the hashing APIs. The key type and signature scheme can impose additional restrictions on which digests can be used. Optional options argument controls the stream.Writable behavior.

In some cases, a Sign instance can be created using the name of a signature algorithm, such as 'RSA-SHA256', instead of a digest algorithm. This will use the corresponding digest algorithm. This does not work for all signature algorithms, such as 'ecdsa-with-SHA256', so it is best to always use digest algorithm names.

crypto.createVerify(algorithm, options?): Verify

Creates and returns a Verify object that uses the given algorithm. Use crypto.getHashes() to obtain the names available to the hashing APIs. The key type and signature scheme can impose additional restrictions on which digests can be used. Optional options argument controls the stream.Writable behavior.

In some cases, a Verify instance can be created using the name of a signature algorithm, such as 'RSA-SHA256', instead of a digest algorithm. This will use the corresponding digest algorithm. This does not work for all signature algorithms, such as 'ecdsa-with-SHA256', so it is best to always use digest algorithm names.

crypto.decapsulate(key, ciphertext, callback?): Buffer

Key decapsulation using a KEM algorithm with a private key.

Supported key types and their KEM algorithms are:

• 'rsa'¹ RSA Secret Value Encapsulation
• 'ec'² DHKEM(P-256, HKDF-SHA256), DHKEM(P-384, HKDF-SHA256), DHKEM(P-521, HKDF-SHA256)
• 'x25519'² DHKEM(X25519, HKDF-SHA256)
• 'x448'² DHKEM(X448, HKDF-SHA512)
• 'ml-kem-512'³ ML-KEM
• 'ml-kem-768'³ ML-KEM
• 'ml-kem-1024'³ ML-KEM

If key is not a KeyObject, this function behaves as if key had been passed to crypto.createPrivateKey().

If the callback function is provided this function uses libuv's threadpool.

crypto.diffieHellman(options, callback?): Buffer

Computes the Diffie-Hellman shared secret based on a privateKey and a publicKey. Both keys must represent the same asymmetric key type and must support either the DH or ECDH operation.

If options.privateKey is not a KeyObject, this function behaves as if options.privateKey had been passed to crypto.createPrivateKey().

If options.publicKey is not a KeyObject, this function behaves as if options.publicKey had been passed to crypto.createPublicKey().

If the callback function is provided this function uses libuv's threadpool.

crypto.encapsulate(key, callback?): Object

Key encapsulation using a KEM algorithm with a public key.

Supported key types and their KEM algorithms are:

• 'rsa'¹ RSA Secret Value Encapsulation
• 'ec'² DHKEM(P-256, HKDF-SHA256), DHKEM(P-384, HKDF-SHA256), DHKEM(P-521, HKDF-SHA256)
• 'x25519'² DHKEM(X25519, HKDF-SHA256)
• 'x448'² DHKEM(X448, HKDF-SHA512)
• 'ml-kem-512'³ ML-KEM
• 'ml-kem-768'³ ML-KEM
• 'ml-kem-1024'³ ML-KEM

If key is not a KeyObject, this function behaves as if key had been passed to crypto.createPublicKey().

If the callback function is provided this function uses libuv's threadpool.

Deprecated property for checking and controlling FIPS mode. Use crypto.getFips() and crypto.setFips() instead.

crypto.generateKey(type, options, callback): void

Asynchronously generates a new random secret key of the given length. The type will determine which validations will be performed on the length.

const {
  generateKey,
} = await import('node:crypto');

generateKey('hmac', { length: 512 }, (err, key) => {
  if (err) throw err;
  console.log(key.export().toString('hex'));  // 46e..........620
});

const {
  generateKey,
} = require('node:crypto');

generateKey('hmac', { length: 512 }, (err, key) => {
  if (err) throw err;
  console.log(key.export().toString('hex'));  // 46e..........620
});

The size of a generated HMAC key should not exceed the block size of the underlying hash function. See crypto.createHmac() for more information.

crypto.generateKeyPair(type, options, callback): void

Generates a new asymmetric key pair of the given type. See the supported asymmetric key types.

For RSA-PSS keys, crypto.getHashes() lists algorithms available to the hashing APIs, but not every listed digest can be encoded in RSA-PSS parameters or is supported by the active RSA implementation.

If a publicKeyEncoding or privateKeyEncoding was specified, this function behaves as if keyObject.export() had been called on its result. Otherwise, the respective part of the key is returned as a KeyObject.

It is recommended to encode public keys as 'spki' and private keys as 'pkcs8' with encryption for long-term storage:

const {
  generateKeyPair,
} = await import('node:crypto');

generateKeyPair('rsa', {
  modulusLength: 4096,
  publicKeyEncoding: {
    type: 'spki',
    format: 'pem',
  },
  privateKeyEncoding: {
    type: 'pkcs8',
    format: 'pem',
    cipher: 'aes-256-cbc',
    passphrase: 'top secret',
  },
}, (err, publicKey, privateKey) => {
  // Handle errors and use the generated key pair.
});

const {
  generateKeyPair,
} = require('node:crypto');

generateKeyPair('rsa', {
  modulusLength: 4096,
  publicKeyEncoding: {
    type: 'spki',
    format: 'pem',
  },
  privateKeyEncoding: {
    type: 'pkcs8',
    format: 'pem',
    cipher: 'aes-256-cbc',
    passphrase: 'top secret',
  },
}, (err, publicKey, privateKey) => {
  // Handle errors and use the generated key pair.
});

On completion, callback will be called with err set to undefined and publicKey / privateKey representing the generated key pair.

If this method is invoked as its util.promisify()ed version, it returns a Promise for an Object with publicKey and privateKey properties.

crypto.generateKeyPairSync(type, options): Object

Generates a new asymmetric key pair of the given type. See the supported asymmetric key types.

For RSA-PSS keys, crypto.getHashes() lists algorithms available to the hashing APIs, but not every listed digest can be encoded in RSA-PSS parameters or is supported by the active RSA implementation.

If a publicKeyEncoding or privateKeyEncoding was specified, this function behaves as if keyObject.export() had been called on its result. Otherwise, the respective part of the key is returned as a KeyObject.

When encoding public keys, it is recommended to use 'spki'. When encoding private keys, it is recommended to use 'pkcs8' with a strong passphrase, and to keep the passphrase confidential.

const {
  generateKeyPairSync,
} = await import('node:crypto');

const {
  publicKey,
  privateKey,
} = generateKeyPairSync('rsa', {
  modulusLength: 4096,
  publicKeyEncoding: {
    type: 'spki',
    format: 'pem',
  },
  privateKeyEncoding: {
    type: 'pkcs8',
    format: 'pem',
    cipher: 'aes-256-cbc',
    passphrase: 'top secret',
  },
});

const {
  generateKeyPairSync,
} = require('node:crypto');

const {
  publicKey,
  privateKey,
} = generateKeyPairSync('rsa', {
  modulusLength: 4096,
  publicKeyEncoding: {
    type: 'spki',
    format: 'pem',
  },
  privateKeyEncoding: {
    type: 'pkcs8',
    format: 'pem',
    cipher: 'aes-256-cbc',
    passphrase: 'top secret',
  },
});

The return value { publicKey, privateKey } represents the generated key pair. When PEM encoding was selected, the respective key will be a string, otherwise it will be a buffer containing the data encoded as DER.

crypto.generateKeySync(type, options): KeyObject

Synchronously generates a new random secret key of the given length. The type will determine which validations will be performed on the length.

const {
  generateKeySync,
} = await import('node:crypto');

const key = generateKeySync('hmac', { length: 512 });
console.log(key.export().toString('hex'));  // e89..........41e

const {
  generateKeySync,
} = require('node:crypto');

const key = generateKeySync('hmac', { length: 512 });
console.log(key.export().toString('hex'));  // e89..........41e

The size of a generated HMAC key should not exceed the block size of the underlying hash function. See crypto.createHmac() for more information.

crypto.generatePrime(size, options?, callback): void

Generates a pseudorandom prime of size bits.

If options.safe is true, the prime will be a safe prime -- that is, (prime - 1) / 2 will also be a prime.

The options.add and options.rem parameters can be used to enforce additional requirements, e.g., for Diffie-Hellman:

• If options.add and options.rem are both set, the prime will satisfy the condition that prime % add = rem.
• If only options.add is set and options.safe is not true, the prime will satisfy the condition that prime % add = 1.
• If only options.add is set and options.safe is set to true, the prime will instead satisfy the condition that prime % add = 3. This is necessary because prime % add = 1 for options.add > 2 would contradict the condition enforced by options.safe.
• options.rem is ignored if options.add is not given.

Both options.add and options.rem must be encoded as big-endian sequences if given as an ArrayBuffer, SharedArrayBuffer, TypedArray, Buffer, or DataView.

By default, the prime is encoded as a big-endian sequence of octets in an ArrayBuffer. If the bigint option is true, then a bigint is provided.

The size of the prime will have a direct impact on how long it takes to generate the prime. The larger the size, the longer it will take. Because we use OpenSSL's BN_generate_prime_ex function, which provides only minimal control over our ability to interrupt the generation process, it is not recommended to generate overly large primes, as doing so may make the process unresponsive.

crypto.generatePrimeSync(size, options?): ArrayBuffer | bigint

Generates a pseudorandom prime of size bits.

If options.safe is true, the prime will be a safe prime -- that is, (prime - 1) / 2 will also be a prime.

The options.add and options.rem parameters can be used to enforce additional requirements, e.g., for Diffie-Hellman:

• If options.add and options.rem are both set, the prime will satisfy the condition that prime % add = rem.
• If only options.add is set and options.safe is not true, the prime will satisfy the condition that prime % add = 1.
• If only options.add is set and options.safe is set to true, the prime will instead satisfy the condition that prime % add = 3. This is necessary because prime % add = 1 for options.add > 2 would contradict the condition enforced by options.safe.
• options.rem is ignored if options.add is not given.

Both options.add and options.rem must be encoded as big-endian sequences if given as an ArrayBuffer, SharedArrayBuffer, TypedArray, Buffer, or DataView.

By default, the prime is encoded as a big-endian sequence of octets in an ArrayBuffer. If the bigint option is true, then a bigint is provided.

The size of the prime will have a direct impact on how long it takes to generate the prime. The larger the size, the longer it will take. Because we use OpenSSL's BN_generate_prime_ex function, which provides only minimal control over our ability to interrupt the generation process, it is not recommended to generate overly large primes, as doing so may make the process unresponsive.

crypto.getCipherInfo(nameOrNid, options?): Object

Returns information about a given cipher.

Some ciphers accept variable length keys and initialization vectors. By default, the crypto.getCipherInfo() method will return the default values for these ciphers. To test if a given key length or iv length is acceptable for given cipher, use the keyLength and ivLength options. If the given values are unacceptable, undefined will be returned.

crypto.getCiphers(): string[]

const {
  getCiphers,
} = await import('node:crypto');

console.log(getCiphers()); // ['aes-128-cbc', 'aes-128-ccm', ...]

const {
  getCiphers,
} = require('node:crypto');

console.log(getCiphers()); // ['aes-128-cbc', 'aes-128-ccm', ...]

crypto.getCurves(): string[]

const {
  getCurves,
} = await import('node:crypto');

console.log(getCurves()); // ['Oakley-EC2N-3', 'Oakley-EC2N-4', ...]

const {
  getCurves,
} = require('node:crypto');

console.log(getCurves()); // ['Oakley-EC2N-3', 'Oakley-EC2N-4', ...]

crypto.getDiffieHellman(groupName): DiffieHellmanGroup

Creates a predefined DiffieHellmanGroup key exchange object. The supported groups are listed in the documentation for DiffieHellmanGroup.

The returned object mimics the interface of objects created by crypto.createDiffieHellman(), but will not allow changing the keys (with diffieHellman.setPublicKey(), for example). The advantage of using this method is that the parties do not have to generate nor exchange a group modulus beforehand, saving both processor and communication time.

Example (obtaining a shared secret):

const {
  getDiffieHellman,
} = await import('node:crypto');
const alice = getDiffieHellman('modp14');
const bob = getDiffieHellman('modp14');

alice.generateKeys();
bob.generateKeys();

const aliceSecret = alice.computeSecret(bob.getPublicKey(), null, 'hex');
const bobSecret = bob.computeSecret(alice.getPublicKey(), null, 'hex');

/* aliceSecret and bobSecret should be the same */
console.log(aliceSecret === bobSecret);

const {
  getDiffieHellman,
} = require('node:crypto');

const alice = getDiffieHellman('modp14');
const bob = getDiffieHellman('modp14');

alice.generateKeys();
bob.generateKeys();

const aliceSecret = alice.computeSecret(bob.getPublicKey(), null, 'hex');
const bobSecret = bob.computeSecret(alice.getPublicKey(), null, 'hex');

/* aliceSecret and bobSecret should be the same */
console.log(aliceSecret === bobSecret);

crypto.getFips(): number

With OpenSSL 3, this reports whether the default property query includes fips=yes. It does not establish that a FIPS provider is loaded or validated. It can return 1 even when a requested cryptographic implementation cannot be fetched because no loaded provider supplies a match for fips=yes. See FIPS mode.

crypto.getHashes(): string[]

This is the authoritative Node.js list of hash algorithms available to crypto.createHash() and crypto.hash() in the current process. With OpenSSL 3 or later, the list depends on the loaded providers and the default property query in effect when the list is first generated. Some listed algorithms can require API-specific options, such as outputLength for XOF hash functions.

A listed hash algorithm is not necessarily supported by APIs that combine a digest with another cryptographic operation, such as HMAC, key derivation, or signing. Those operations can apply additional restrictions.

const {
  getHashes,
} = await import('node:crypto');

console.log(getHashes()); // ['DSA', 'DSA-SHA', 'DSA-SHA1', ...]

const {
  getHashes,
} = require('node:crypto');

console.log(getHashes()); // ['DSA', 'DSA-SHA', 'DSA-SHA1', ...]

crypto.getMacs(): string[]

Returns MAC names exposed by loaded OpenSSL providers that match the active default property query. Duplicate names and numeric OID aliases are omitted. On builds without OpenSSL EVP_MAC support, this function returns an empty array.

The returned names describe implementations that OpenSSL can fetch. They do not guarantee that crypto.createMac() can initialize the MAC without additional options. A provider can require additional parameters or a key with algorithm-specific properties, and it can expose parameters that this API does not support.

After a successful FIPS mode change made with crypto.setFips(), subsequent calls reflect the new mode, and newly created Mac objects use it. Existing Mac objects continue using the provider implementation selected when they were created.

const { getMacs } = await import('node:crypto');

console.log(getMacs());
// ['blake2bmac', 'blake2smac', 'cmac', 'gmac', 'hmac', ...]

crypto.getRandomValues(typedArray): Buffer | TypedArray | DataView | ArrayBuffer