# @atproto/crypto

> Library for cryptographic keys and signing in atproto

Latest version **0.5.7** (published 2026-10-02) · MIT license · 0 weekly downloads

## Install

```sh
npm install @atproto/crypto
pnpm add @atproto/crypto
yarn add @atproto/crypto
bun add @atproto/crypto
```

## Health

**Score 65/100 (B)** — status: active.

Positive: esm support; no vulnerabilities; has provenance; recently updated; high maintenance score.

Warnings: low downloads; no types; pre 1.0.

## Facts

| | |
|---|---|
| Version | 0.5.7 |
| Published | 2026-10-02 |
| First published | 2023-01-24 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | none |
| Module format | ESM |
| Node | >=22 |
| Dependencies | 3 |
| Unpacked size | 72.2 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Provenance | attested (GitHub Actions) |
| GitHub stars | 9679 |
| Maintainers | dholms, pfrazee, devinivy, estrattonbailey, matthieu-bluesky |
| Keywords | atproto, cryptography |

## Links

- npm: https://www.npmjs.com/package/@atproto/crypto
- Repository: https://github.com/bluesky-social/atproto
- Homepage: https://atproto.com
- npm.io page: https://npm.io/package/@atproto/crypto

## Dependencies (3)

- [uint8arrays](https://npm.io/package/uint8arrays.md) ^5.0.0
- [@noble/curves](https://npm.io/package/@noble/curves.md) ^1.7.0
- [@noble/hashes](https://npm.io/package/@noble/hashes.md) ^1.6.1

## Alternatives

- [@gemini-wallet/core](https://npm.io/package/@gemini-wallet/core.md) — 515.6K weekly downloads
- [utility](https://npm.io/package/utility.md) — 416.6K weekly downloads
- [@primno/dpapi](https://npm.io/package/@primno/dpapi.md) — 7.2K weekly downloads
- [pi-readseek](https://npm.io/package/pi-readseek.md) — 3.7K weekly downloads
- [@emilia-protocol/verify](https://npm.io/package/@emilia-protocol/verify.md) — 1.1K weekly downloads

## Recent versions

- 0.5.7 (latest) — 2026-10-02
- 0.0.0-spaces-alpha-20261105160032 (alpha) — 2026-11-05
- 0.5.0-next.0 (next) — 2026-05-18
- 0.0.0-spaces-alpha-20261029171913 — 2026-10-29
- 0.0.0-spaces-alpha-20261022141228 — 2026-10-22
- 0.0.0-spaces-alpha-20261015143509 — 2026-10-15
- 0.0.0-spaces-alpha-20261001173819 — 2026-10-01
- 0.5.6 — 2026-09-29
- 0.0.0-spaces-alpha-20260915165437 — 2026-09-15
- 0.0.0-spaces-alpha-20260915164701 — 2026-09-15
- 0.0.0-spaces-alpha-20260913191958 — 2026-09-13
- 0.5.5 — 2026-09-11
- 0.0.0-spaces-alpha-20260910230440 — 2026-09-10
- 0.0.0-spaces-alpha-20260910223605 — 2026-09-10
- 0.0.0-spaces-alpha-20260910222405 — 2026-09-10
- … 24 more at https://npm.io/package/@atproto/crypto/versions

## README

# @atproto/crypto

TypeScript library providing basic cryptographic helpers as needed in [atproto](https://atproto.com).

[![NPM](https://img.shields.io/npm/v/@atproto/crypto)](https://www.npmjs.com/package/@atproto/crypto)
[![Github CI Status](https://github.com/bluesky-social/atproto/actions/workflows/repo.yaml/badge.svg)](https://github.com/bluesky-social/atproto/actions/workflows/repo.yaml)

This package implements the two currently supported cryptographic systems:

- P-256 elliptic curve: aka "NIST P-256", aka secp256r1 (note the r), aka prime256v1
- K-256 elliptic curve: aka "NIST K-256", aka secp256k1 (note the k)

The details of cryptography in atproto are described in [the specification](https://atproto.com/specs/cryptography). This includes string encodings, validity of "low-S" signatures, byte representation "compression", hashing, and more.

## Usage

```typescript
import { verifySignature, Secp256k1Keypair, P256Keypair } from '@atproto/crypto'

// generate a new random K-256 private key
const keypair = await Secp256k1Keypair.create({ exportable: true })

// sign binary data, resulting signature bytes.
// SHA-256 hash of data is what actually gets signed.
// signature output is often base64-encoded.
const data = new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8])
const sig = await keypair.sign(data)

// serialize the public key as a did:key string, which includes key type metadata
const pubDidKey = keypair.did()
console.log(pubDidKey)

// output would look something like: 'did:key:zQ3shVRtgqTRHC7Lj4DYScoDgReNpsDp3HBnuKBKt1FSXKQ38'

// verify signature using public key
const ok = verifySignature(pubDidKey, data, sig)
if (!ok) {
  throw new Error('Uh oh, something is fishy')
} else {
  console.log('Success')
}
```

## License

This project is dual-licensed under MIT and Apache 2.0 terms:

- MIT license ([LICENSE-MIT.txt](https://github.com/bluesky-social/atproto/blob/main/LICENSE-MIT.txt) or http://opensource.org/licenses/MIT)
- Apache License, Version 2.0, ([LICENSE-APACHE.txt](https://github.com/bluesky-social/atproto/blob/main/LICENSE-APACHE.txt) or http://www.apache.org/licenses/LICENSE-2.0)

Downstream projects and end users may chose either license individually, or both together, at their discretion. The motivation for this dual-licensing is the additional software patent assurance provided by Apache 2.0.

---
_Source: https://npm.io/package/@atproto/crypto · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._