# @otplib/plugin-crypto-noble

> Pure JavaScript crypto implementation using noble-hashes for otplib

Latest version **13.5.0** (published 2026-08-21) · MIT license · 0 weekly downloads

## Install

```sh
npm install @otplib/plugin-crypto-noble
pnpm add @otplib/plugin-crypto-noble
yarn add @otplib/plugin-crypto-noble
bun add @otplib/plugin-crypto-noble
```

## Health

**Score 75/100 (B)** — status: active.

Positive: has types; esm support; no vulnerabilities; has provenance; recently updated; high maintenance score; high quality score.

Warnings: low downloads.

## Facts

| | |
|---|---|
| Version | 13.5.0 |
| Published | 2026-08-21 |
| First published | 2026-01-10 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | ESM + CommonJS |
| Dependencies | 2 |
| Unpacked size | 25.2 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Provenance | attested (GitHub Actions) |
| GitHub stars | 2291 |
| Author | Gerald Yeo |
| Maintainers | geraldyeo |
| Keywords | otp, crypto, noble-hashes, hmac, plugin, browser |

## Links

- npm: https://www.npmjs.com/package/@otplib/plugin-crypto-noble
- Repository: https://github.com/yeojz/otplib
- Homepage: https://otplib.yeojz.dev
- Issues: https://github.com/yeojz/otplib/issues
- npm.io page: https://npm.io/package/@otplib/plugin-crypto-noble

## Dependencies (2)

- [@otplib/core](https://npm.io/package/@otplib/core.md) 13.5.0
- [@noble/hashes](https://npm.io/package/@noble/hashes.md) ^2.2.0

## Alternatives

- [@gemini-wallet/core](https://npm.io/package/@gemini-wallet/core.md) — 515.6K weekly downloads
- [utility](https://npm.io/package/utility.md) — 416.6K weekly downloads
- [@primno/dpapi](https://npm.io/package/@primno/dpapi.md) — 7.2K weekly downloads
- [pi-readseek](https://npm.io/package/pi-readseek.md) — 3.7K weekly downloads
- [@emilia-protocol/verify](https://npm.io/package/@emilia-protocol/verify.md) — 1.1K weekly downloads

## Recent versions

- 13.5.0 (latest) — 2026-08-21
- 13.4.1 — 2026-05-30
- 13.4.0 — 2026-03-19
- 13.3.0 — 2026-02-12
- 13.2.1 — 2026-01-26
- 13.2.0 — 2026-01-25
- 13.1.1 — 2026-01-14
- 13.1.0 — 2026-01-12
- 13.0.2 — 2026-01-11
- 13.0.1 — 2026-01-10
- 13.0.0 — 2026-01-10

## README

# @otplib/plugin-crypto-noble

Pure JavaScript crypto plugin for otplib using [@noble/hashes](https://github.com/paulmillr/noble-hashes).

## Installation

```bash
npm install @otplib/plugin-crypto-noble
pnpm add @otplib/plugin-crypto-noble
yarn add @otplib/plugin-crypto-noble
```

## Overview

This plugin provides HMAC and random byte generation using the `@noble/hashes` library - a zero-dependency, audited cryptographic implementation in pure JavaScript. It supports all standard hash algorithms:

- `sha1`
- `sha256`
- `sha512`

## Usage

### Basic Usage

```typescript
import { generateSecret, generate } from "otplib";
import { crypto } from "@otplib/plugin-crypto-noble";
import { base32 } from "@otplib/plugin-base32-scure";

// Generate a secret
const secret = generateSecret({ crypto, base32 });

// Generate a token
const token = await generate({
  secret,
  crypto,
  base32,
});
```

### With Custom Algorithm

```typescript
import { generate } from "otplib";
import { crypto } from "@otplib/plugin-crypto-noble";
import { base32 } from "@otplib/plugin-base32-scure";

const token = await generate({
  secret: "GEZDGNBVGY3TQOJQGEZDGNBVGY",
  algorithm: "sha256",
  crypto,
  base32,
});
```

### Synchronous Operations

The noble crypto plugin supports both synchronous and asynchronous HMAC operations:

```typescript
import { crypto } from "@otplib/plugin-crypto-noble";

// Sync HMAC (useful for high-volume operations)
const digest = crypto.hmacSync("sha1", key, data);

// Async HMAC (consistent API with web crypto)
const digest = await crypto.hmac("sha1", key, data);
```

## When to Use

Use this plugin when:

- **Cross-platform compatibility** is required (works in Node.js, browsers, and edge runtimes)
- Running in **edge runtimes** that don't support Web Crypto API fully
- Need a **pure JavaScript** implementation without native dependencies
- Want **audited crypto** from a well-maintained library
- Building **isomorphic applications** that run on both server and client
- Need **synchronous HMAC** operations in environments without Node.js crypto

## Security Considerations

- Uses [@noble/hashes](https://github.com/paulmillr/noble-hashes) which is audited and widely used
- Pure JavaScript implementation - no WebAssembly or native bindings
- Cryptographically secure random bytes using the platform's CSPRNG

## Comparison with Other Plugins

| Feature      | plugin-crypto-noble | plugin-crypto-node | plugin-crypto-web |
| ------------ | ------------------- | ------------------ | ----------------- |
| Node.js      | Yes                 | Yes                | No                |
| Browser      | Yes                 | No                 | Yes               |
| Edge Runtime | Yes                 | No                 | Yes               |
| Sync HMAC    | Yes                 | Yes                | No                |
| Pure JS      | Yes                 | No                 | No                |
| Dependencies | @noble/hashes       | None               | None              |

## Bundle Size

The `@noble/hashes` library adds approximately 15KB (gzipped) to your bundle. For browser applications where bundle size is critical, consider using `@otplib/plugin-crypto-web` instead.

## Documentation

Full documentation available at [otplib.yeojz.dev](https://otplib.yeojz.dev):

- [Getting Started Guide](https://otplib.yeojz.dev/guide/getting-started)
- [API Reference](https://otplib.yeojz.dev/api/)

## License

[MIT](./LICENSE)

---
_Source: https://npm.io/package/@otplib/plugin-crypto-noble · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._