# secret-utils > Common `crypto` snippets (generate random bytes, salt, hash password, etc) Latest version **2.0.0** (published 2015-07-31) · Apache2 license · 0 weekly downloads ## Install ```sh npm install secret-utils pnpm add secret-utils yarn add secret-utils bun add secret-utils ``` ## Health **Score 15/100 (F)** — status: abandoned. Positive: no vulnerabilities. Warnings: low downloads; no types; no esm support. Negative: abandoned; low maintenance score. ## Facts | | | |---|---| | Version | 2.0.0 | | Published | 2015-07-31 | | First published | 2014-10-13 | | Weekly downloads | 0 | | License | Apache2 | | TypeScript types | none | | Module format | CommonJS | | Dependencies | 2 | | Known vulnerabilities | 0 | | Install scripts | no | | GitHub stars | 4 | | Author | AJ ONeal | | Maintainers | coolaj86 | | Keywords | crypto, hashsum, md5sum, shasum, sha1sum, sh256sum, sha384sum, sha512sum, secret, password, passphrase, shadow, hash, string, int, integer, number, range | ## Links - npm: https://www.npmjs.com/package/secret-utils - Repository: https://github.com/coolaj86/secret-utils - Issues: https://github.com/coolaj86/secret-utils/issues - npm.io page: https://npm.io/package/secret-utils ## Dependencies (2) - [crypto-rand](https://npm.io/package/crypto-rand.md) 0.0.2 - [urlsafe-base64](https://npm.io/package/urlsafe-base64.md) 0.0.2 ## Alternatives - [eslint-plugin-sonarjs](https://npm.io/package/eslint-plugin-sonarjs.md) — 2.9M weekly downloads - [eslint-config-expo](https://npm.io/package/eslint-config-expo.md) — 1.5M weekly downloads - [@matter/protocol](https://npm.io/package/@matter/protocol.md) — 63.5K weekly downloads - [@eventcatalog/linter](https://npm.io/package/@eventcatalog/linter.md) — 24.8K weekly downloads - [@pandacss/eslint-plugin](https://npm.io/package/@pandacss/eslint-plugin.md) — 18.7K weekly downloads ## Recent versions - 2.0.0 (latest) — 2015-07-31 - 1.0.2 — 2014-10-14 - 1.0.1 — 2014-10-13 - 1.0.0 — 2014-10-13 ## README secret-utils ============ Common `crypto` snippets (generate random bytes, salt, hash password, etc) You should use the Node.js modules for `bcrypt` or `scrypt`, but if you'd rather have pure Node.js JavaScript without compiled modules, well, here you go. ```bash npm install --save secret-utils ``` ```javascript var secretutils = require('secret-utils'); secretutils.url64(32); // '1cCk4GzgSDjbuFSRHOrte5_WHW02oYQwaxetY72UxPc' ``` API === * createShadow * testSecret * url64 * random * int * hashsum * sha1sum * sha256sum * alphanum ### .createShadow() `createShadow(secret[, hashtype[, salt ]])` ```javascript secretutils.createShadow("secret"); // output { salt: 'rVhp3Lb7WktdzC0DY9TZtHOOVtdZVWeMCv6YLKizaWI' , shadow: 'e26f053d55a744e823f37d1caacd9bb4c082f4ec09fe891e60890f8f8505882c' , hashtype: 'sha256' } ``` Given a secret (password, passphrase, etc), returns a shadow, hashtype, and salt. `hashtype` defaults to `sha256` `salt` defaults to `url64(32)` ### .testSecret() `testSecret(salt, secret, shadow[, hashtype ])` ```javascript secretutils.testSecret('rVhp3Lb7WktdzC0DY9TZtHOOVtdZVWeMCv6YLKizaWI', "secret", 'e26f053d55a744e823f37d1caacd9bb4c082f4ec09fe891e60890f8f8505882c'); // true ``` Given a salt, secret, shadow (and hashtype), determine if the secret matches the shadow. `hashtype` defaults to `sha256` returns `true` or `false` ### .genSalt() `genSalt(len)` ```javascript secretutils.genSalt(32); // '1cCk4GzgSDjbuFSRHOrte5_WHW02oYQwaxetY72UxPc' ``` Alias of `.url64(len)` ### .url64() `url64(len)` ```javascript secretutils.url64(32); // '1cCk4GzgSDjbuFSRHOrte5_WHW02oYQwaxetY72UxPc' ``` Creates a url-safe base64 string with a given entropy NOTE that a length of 96 bytes would become a 128-char string Source: ```javascript crypto.randomBytes(len || 32) .toString('base64') .replace(/\+/g, '-') // Convert '+' to '-' .replace(/\//g, '_') // Convert '/' to '_' .replace(/=+$/, '') // Remove ending '=' ; ``` ### .random() `random(len[, encoding])` ```javascript secretutils.random(32); // ``` Generate a securely random `Buffer` with `len` bytes of entropy, optionally encoded as a string. ### .int() `int(min, max)` ```javascript secretutils.int(1, 6); // 1 ``` Generate a securely random 48-bit integer. ### .hashsum() `hashsum(hashtype, str)` ```javascript secretutils.hashsum('sha1', 'e26f053d55a744e823f37d1caacd9bb4c082f4ec09fe891e60890f8f8505882c' + 'secret'); // 'a0d281586a74a2bc49414c683b5729aa39c6204b' ``` Return the hash of a given string. Useful for short strings, not for large buffers. Source: ```javascript return require('crypto').createHash(hashtype).update(val).digest('hex'); ``` ### .sha1sum() `sha1sum(str)` ```javascript secretutils.sha1sum('e26f053d55a744e823f37d1caacd9bb4c082f4ec09fe891e60890f8f8505882c' + 'secret'); // 'a0d281586a74a2bc49414c683b5729aa39c6204b' ``` Return the sha1sum of a given string. Useful for short strings, not for large buffers. Source: ```javascript return require('crypto').createHash('sha1').update(val).digest('hex'); ``` ### .sha256sum() `sha256sum(str)` ```javascript secretutils.sha256sum('e26f053d55a744e823f37d1caacd9bb4c082f4ec09fe891e60890f8f8505882c' + 'secret'); // 'b81efbad017cbe4f785fb9603cc732d5f0263b34edc1e37f2cb13e13aa0f392b' ``` Return the sha1sum of a given string. Useful for short strings, not for large buffers. Source: ```javascript return require('crypto').createHash('sha256').update(val).digest('hex'); ``` ### .alphanum() `alphanum(len)` ```javascript secretutils.alphanum(16); // ktp827asite9kp7x ``` Return an alphanumeric (A-Za-z0-9) string (insecure, using `Math.random()`). Why? ==== Most of the `crypto` functions are built on a stream-esque API, but many of the common use cases for crypto involve very short strings. `sha1sum(str)` is simply easier to read (and write) at-a-glance than `require('crypto').createHash('sha1').update(val).digest('hex');` Removing a minor annoyance, that's all. Thanks ====== Code snatched from * `crypto-rand` * `urlsafe-base64` --- _Source: https://npm.io/package/secret-utils · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._