Required dependencies

# No runtime npm dependencies — crypto-js is self-contained.
# For TypeScript type definitions:
npm install --save-dev @types/crypto-js

No native build steps, no pod install, no Android linking required. The library uses the platform's native crypto module (Node.js require('crypto') or window.crypto) only for CSPRNG; all algorithm logic is pure JS.

Project setup

1. Copy the entire source/ directory into your project, e.g. src/vendor/crypto-js/.
2. The files use a global CryptoJS variable and are written as plain IIFE scripts. Load them in dependency order: core.js first, then any encoders/KDFs, then cipher infrastructure (cipher-core.js, mode files, padding files), then individual algorithms.
3. For a CommonJS / Node.js project the easiest approach is to install the npm package directly and import individual modules (each npm entry point wraps the source files in the correct order):

npm install crypto-js

4. For TypeScript add to tsconfig.json:

{
  "compilerOptions": {
    "esModuleInterop": true,
    "allowSyntheticDefaultImports": true
  }
}

5. If you are bundling the raw source/ files with webpack/Rollup, set up an alias so every algorithm can resolve core.js before it runs:

// webpack.config.js
resolve: {
  alias: {
    'cryptojs-core': path.resolve(__dirname, 'src/vendor/crypto-js/core.js')
  }
}

6. No environment variables are required.

Public API

CryptoJS.AES.encrypt / CryptoJS.AES.decrypt

import AES from 'crypto-js/aes';
import Utf8 from 'crypto-js/enc-utf8'; // re-exported from core

// encrypt
const cipherParams: CryptoJS.lib.CipherParams =
  AES.encrypt(message: string | WordArray, key: string | WordArray, cfg?: object): CryptoJS.lib.CipherParams;

// decrypt
const wordArray: CryptoJS.lib.WordArray =
  AES.decrypt(ciphertext: string | CipherParams, key: string | WordArray, cfg?: object): CryptoJS.lib.WordArray;

Use when you need symmetric encryption. When key is a plain string the library derives the actual key and IV via EVP KDF internally. Pass a WordArray key + explicit iv in cfg when you control key material directly.

Cipher.createEncryptor / Cipher.createDecryptor

// Defined on any BlockCipher subclass (AES, TripleDES, Blowfish, …)
CryptoJS.algo.AES.createEncryptor(key: WordArray, cfg?: { iv?: WordArray; mode?: object; padding?: object }): Cipher;
CryptoJS.algo.AES.createDecryptor(key: WordArray, cfg?: { iv?: WordArray; mode?: object; padding?: object }): Cipher;

Use these when you need a low-level, stateful cipher instance — for example when encrypting a stream in chunks by calling .process(chunk) repeatedly and finalising with .finalize().

CryptoJS.lib.WordArray

// Construction
CryptoJS.lib.WordArray.create(words?: number[], sigBytes?: number): WordArray;
// Encoding
wordArray.toString(encoder?: Encoder): string;   // default: Hex
// Concatenation
wordArray.concat(other: WordArray): WordArray;

The internal binary representation used everywhere. Convert to/from Base64, Hex, or Utf8 via the encoders in enc-base64.js, core.js.

Working examples

Scenario - AES-256 string encryption with a passphrase

A quick encrypt/decrypt cycle using a string passphrase (EVP KDF key derivation). Suitable for non-critical storage; prefer explicit key + IV for production.

import CryptoJS from 'crypto-js';

const passphrase = 'super-secret-passphrase';
const plaintext  = 'Hello, World!';

// Encrypt
const ciphertext: string = CryptoJS.AES.encrypt(plaintext, passphrase).toString();
console.log('Encrypted:', ciphertext);

// Decrypt
const bytes      = CryptoJS.AES.decrypt(ciphertext, passphrase);
const recovered  = bytes.toString(CryptoJS.enc.Utf8);
console.log('Decrypted:', recovered); // 'Hello, World!'

Scenario - AES-CBC with explicit key and IV

Use this when you supply your own key material (e.g. derived via PBKDF2 elsewhere).

import CryptoJS from 'crypto-js';

const key = CryptoJS.enc.Hex.parse('000102030405060708090a0b0c0d0e0f');
const iv  = CryptoJS.enc.Hex.parse('101112131415161718191a1b1c1d1e1f');

const encrypted = CryptoJS.AES.encrypt('sensitive data', key, {
  iv,
  mode:    CryptoJS.mode.CBC,
  padding: CryptoJS.pad.Pkcs7,
});

const decrypted = CryptoJS.AES.decrypt(encrypted, key, {
  iv,
  mode:    CryptoJS.mode.CBC,
  padding: CryptoJS.pad.Pkcs7,
});

console.log(decrypted.toString(CryptoJS.enc.Utf8)); // 'sensitive data'

Scenario - HMAC-SHA256 request signing

Sign an API request payload and encode the result as Base64 — a common pattern for webhook verification.

import hmacSHA256 from 'crypto-js/hmac-sha256';
import Base64     from 'crypto-js/enc-base64';

const privateKey = 'my-api-secret';
const payload    = JSON.stringify({ event: 'charge.succeeded', id: 42 });

const signature  = Base64.stringify(hmacSHA256(payload, privateKey));
console.log('X-Signature:', signature);
// Verify on the other end:
const expected   = Base64.stringify(hmacSHA256(payload, privateKey));
const valid      = signature === expected;

Scenario - PBKDF2 key derivation

Derive a cryptographic key from a user password before using it with AES.

import CryptoJS from 'crypto-js';

const password   = 'user-supplied-password';
const salt       = CryptoJS.lib.WordArray.random(128 / 8);

const key256     = CryptoJS.PBKDF2(password, salt, {
  keySize:    256 / 32,
  iterations: 100000,
});

const iv = CryptoJS.lib.WordArray.random(128 / 8);

const ciphertext = CryptoJS.AES.encrypt('secret', key256, { iv }).toString();
console.log(ciphertext);

File walkthrough

• core.js — Bootstraps the CryptoJS global, implements Base, WordArray, BufferedBlockAlgorithm, and the Hex/Latin1/Utf8 encoders. Must load before everything else.
• cipher-core.js — Defines the abstract Cipher, BlockCipher, StreamCipher hierarchy plus SerializableCipher and PasswordBasedCipher (which wrap algorithms with Base64 serialisation and EVP KDF).
• aes.js — Concrete AES implementation extending BlockCipher; exposes CryptoJS.AES.
• tripledes.js — DES and Triple-DES implementations with full PC1/PC2/S-box tables; exposes CryptoJS.TripleDES and CryptoJS.DES.
• blowfish.js — Blowfish block cipher with full P-array and S-box initialisation; exposes CryptoJS.Blowfish.
• rc4.js — RC4 stream cipher; exposes CryptoJS.RC4 and CryptoJS.RC4Drop.
• rabbit.js / rabbit-legacy.js — Rabbit stream cipher (current and legacy IV variants).
• md5.js, sha1.js, sha256.js, sha224.js, sha512.js, sha384.js, sha3.js, ripemd160.js — Standalone hash algorithms, each extending Hasher.
• hmac.js — HMAC construction; wraps any Hasher; used by the hmac-* entry points.
• pbkdf2.js — PBKDF2 implementation using HMAC-SHA1 internally.
• evpkdf.js — OpenSSL EVP_BytesToKey used internally by PasswordBasedCipher.
• enc-base64.js / enc-base64url.js / enc-utf16.js — Encoder objects with .stringify(wordArray) and .parse(string).
• lib-typedarrays.js — Patches WordArray to accept ArrayBuffer and typed arrays in .create().
• x64-core.js — 64-bit X64Word and X64WordArray types needed by SHA-512 and SHA-3.
• format-hex.js — Alternative CipherParams formatter that serialises ciphertext as hex instead of Base64.
• mode-cfb.js, mode-ctr.js, mode-ctr-gladman.js, mode-ecb.js, mode-ofb.js — Block cipher mode implementations passed as cfg.mode.
• pad-ansix923.js, pad-iso10126.js, pad-iso97971.js, pad-nopadding.js, pad-zeropadding.js — Padding scheme implementations passed as cfg.padding.

Common pitfalls and fixes

• Loading order with raw source files: cipher-core.js reads CryptoJS.enc.Base64 and CryptoJS.algo.EvpKDF, so enc-base64.js and evpkdf.js must be loaded before it. Fix: always start with core.js → encoders → evpkdf.js → cipher-core.js → modes → pads → algorithms.
• String passphrase vs WordArray key: When you pass a plain string as the key, the library silently invokes EVP KDF and embeds a salt in the output; passing a WordArray key skips KDF entirely and uses the bytes directly. Fix: be explicit — always use CryptoJS.enc.Hex.parse(...) when you have raw key bytes.
• WordArray.toString() defaults to Hex: Calling .toString() without an encoder returns a hex string, not UTF-8. Fix: always pass CryptoJS.enc.Utf8 (or Base64) explicitly when recovering plaintext.
• TypeScript default import: crypto-js ships CJS modules; with "esModuleInterop": false the named import import CryptoJS from 'crypto-js' fails. Fix: set "esModuleInterop": true or use import * as CryptoJS from 'crypto-js'.
• lib-typedarrays.js not loaded: Passing an ArrayBuffer to WordArray.create() throws unless lib-typedarrays.js has been loaded. Fix: require('crypto-js/lib-typedarrays') before any code that converts typed arrays.
• CTR mode counter endianness: mode-ctr.js (big-endian) and mode-ctr-gladman.js (little-endian) produce different ciphertexts for the same IV. Fix: pick one variant and use it consistently on both ends; default CryptoJS.mode.CTR is the big-endian version.

Vibe-coding prompt template

I have dropped the crypto-js 4.2.0 source files into `src/vendor/crypto-js/`
in my project. I also have USAGE.md (the integration guide) open.

Please help me integrate crypto-js into my project step by step:

1. Read USAGE.md and the source files in `src/vendor/crypto-js/` to understand
   the available algorithms and their real exports.

2. Install any missing dev dependencies (e.g. `@types/crypto-js`) and update
   `tsconfig.json` so TypeScript resolves the module correctly.

3. Implement the following feature using the real API from the source:
   [DESCRIBE YOUR USE CASE — e.g. "AES-CBC encryption of user data with a
   PBKDF2-derived key, returning a Base64-encoded ciphertext string"]

4. Show the full import statements referencing `crypto-js` (or the vendor path),
   the implementation, and a brief test that encrypts and then decrypts to
   verify round-trip correctness.

5. Point out any loading-order or ESM/CJS interop issues specific to my
   project setup and how to fix them.

Upstream package: user@example.com
Integration guide: USAGE.md
Source location: src/vendor/crypto-js/

License and credit

CryptoJS is released under the MIT License. See source/LICENSE if present, or the npm package page for the full license text. Upstream repository: https://github.com/brix/crypto-js. Note that the upstream project is discontinued; consider migrating to the Node.js built-in crypto module or the Web Crypto API for new projects.

This product’s unique contribution is clean room implementation of valuable code block into AVCP compatible standard.

The full install guide and integration prompts unlock after purchase.

JSON Object Signing and Encryption for Node.js

Automation, Utilities & Developer Tools

Free