• March 2026 self-audit (all files): no major issues found
  • Audited for spec compliance and security
  • Fix: dkLen=0 handling in pbkdf2, blake2, turboshake, kt
  • Fix: parallelHash with blockLen=0
  • Fix: argon2 progress callback now reaches 100%
  • Improve: digestInto no longer returns a value (better performance)
  • Improve: argon2, blake2 support non-4-divisible dkLen
• Fix all Byte Array types, to ensure proper work in both TypeScript 5.6 & TypeScript 5.9+
  • TS 5.6 has Uint8Array, while TS 5.9+ made it generic Uint8Array<ArrayBuffer>
  • This creates incompatibility of code between versions
  • Previously, it was hard to use and constantly emitted errors similar to TS2345
  • See typescript#62240 for more context
• sha3: speed-up by up to 50%. Contributed by @ChALkeR in #126
• Fix compilation issues on TypeScript v6
• Make package Big Endian friendly. All tests pass on s390x
• Improve tree-shaking, reduce bundle sizes
• Add massive amounts of documentation everywhere

(We're skipping v2.1, to align with other noble packages)

Full Changelog: 2.0.1...2.2.0

• .js extension must be used for all modules
  • Old: @noble/hashes/sha3
  • New: @noble/hashes/sha3.js
  • This simplifies working in browsers natively without transpilers
  • This was planned for 2.0.0, but was accidentally left out
• package.json: specify exported submodules to ensure typescript autocompletion
• scrypt: Fix error message for maxmem check by @ChALkeR in #121
• scrypt: 4% speed-up by @ChALkeR in #122

Full Changelog: 2.0.0...2.0.1

High-level

• The package is now ESM-only. ESM can finally be loaded from common.js on node v20.19+
  • Node v20.19 is now the minimum required version
  • Package imports now work correctly in bundler-less environments, such as browsers
  • Reduces npm package size (traffic consumed): 152KB => 136KB
  • Reduces unpacked npm size (on-disk space): 1.1MB => 669KB
• Make bundle sizes smaller, compared to v1.x
• .js extension must be used for all modules
  • Old: @noble/hashes/sha3
  • New: @noble/hashes/sha3.js
  • This simplifies working in browsers natively without transpilers

Changes

• Only allow Uint8Array as hash inputs, prohibit string
  • Strict validation checks improve security
  • To replicate previous behavior, use utils.utf8ToBytes
• Rename / remove some modules for consistency. Previously, sha384 resided in sha512, which was weird
  • sha256, sha512 => sha2.js (consistent with sha3.js)
  • blake2b, blake2s => blake2.js (consistent with blake3.js, blake1.js)
  • ripemd160, sha1, md5 => legacy.js (all low-security hashes are there)
  • _assert => utils.js
  • crypto internal module got removed: use built-in WebCrypto instead
• Improve typescript types & option autocomplete
• Upgrade typescript compilation env to ts5.9 and es2022
• Massively improve error messages, make them more descriptive

Full Changelog: 1.8.0...2.0.0

Preparation for v2

The release contains bugfixes and a few improvements which pave the way for upcoming v2.0.

• Modules are now available with .js extension
  • Old: @noble/hashes/sha2
  • New: @noble/hashes/sha2.js
  • Old path is still available
  • This simplifies working in browsers natively without transpilers
• Refactor core functionality, remove duplicate code
• Decrease package size

Deprecations

In v2, some modules will be removed. For example, sha256 will become sha2. In v1.8, the old names still exist, but are marked as deprecated, to simplify upgrade path.

One of the reasons for moving those was the fact sha384 resided in sha512, sha224 in sha256 - which was confusing. New naming scheme simplifies reasoning and decreases amount of modules.

• sha256 became sha2 (which already existed for several releases)
• sha512 became sha2
• _assert became utils
• blake2b became blake2
• blake2s became blake2
• ripemd160 became legacy (to signify its low security level 2^80)
• sha1 became legacy

Full Changelog: 1.7.2...1.8.0

• legacy: new module, with md5 hash
• sha1: move to legacy, keep old alias until major release
• utils: randomBytes should ensure Uint8Array output for old node.js versions
• utils: use built-in Uint8Array toHex / fromHex when available. Gives 13x speed-up on 256b arrays, 20x speed-up on 32kb arrays
• Typescript source can now be used without compilation in node.js v24, due to erasableSyntaxOnly

Full Changelog: 1.7.1...1.7.2

• Implement blake1 (sha3 proposal)
• Use typescript verbatimModuleSyntax to support future node.js type stripping
• Improve documentation

Full Changelog: 1.7.0...1.7.1

• The package is now available on JSR.
• Use isolatedDeclarations typescript option, which massively simplifies documentation auto-gen, and more
  • Check out JSR page for one example
• Add tons of comments everywhere to improve autocompletion, LLM code gen, and basic code understanding.
• Remove some exports from internal _assert

New Contributors

• @quentinadam made their first contribution in #103

Full Changelog: 1.6.1...1.7.0

• Fix argon2 initialization
• pkg.json: include d.ts.map

Full Changelog: 1.6.0...1.6.1

• Add support for 4GB+ arrays on supported platforms
• argon2: Harden, make it stable
• utils: Improve isBytes speed
• Improve compatibility with parsers & minifiers

New Contributors

• @mahnunchik made their first contribution in #102

Full Changelog: 1.5.0...1.6.0

• Scrypt: relax params check to allow r: 1, p: 8
• Export additional typescript types
• Add support for node.js v14.21.3 in addition to v16+
• Export sha224, sha384, sha512_224, sha512_256 in single-file build

New Contributors

• @quixoten made their first contribution in #89
• @legobeat made their first contribution in #94
• @iAchilles made their first contribution in #92
• @sreyemnayr made their first contribution in #99

Full Changelog: 1.4.0...1.5.0