@alt-javascript/jasypt

A Node.js implementation of Java's Jasypt password-based encryption and digest utilities. Interoperable with Spring Boot applications that use ENC(...) encrypted configuration values.

Quick Start

npm install @alt-javascript/jasypt

import Jasypt from '@alt-javascript/jasypt';

const jasypt = new Jasypt();

// Encrypt and decrypt
const encrypted = jasypt.encrypt('admin', 'mySecretKey');
const decrypted = jasypt.decrypt(encrypted, 'mySecretKey');
// decrypted === 'admin'

Installation

npm install @alt-javascript/jasypt

Or install globally for the CLI:

npm install -g @alt-javascript/jasypt

Requires Node.js 18 or later.

API

Jasypt

The main class provides high-level encrypt, decrypt, and digest operations.

import Jasypt from '@alt-javascript/jasypt';

const jasypt = new Jasypt();

jasypt.encrypt(message, password [, algorithm [, iterations [, salt]]])

Encrypts a plaintext string. Returns a base64-encoded ciphertext with the salt prepended.

jasypt.encrypt('admin', 'secret');
// => 'nsbC5r0ymz740/aURtuRWw=='

jasypt.encrypt('admin', 'secret', 'PBEWITHHMACSHA256ANDAES_256');
// => 'K3q8z...' (AES-256-CBC ciphertext)

jasypt.decrypt(encryptedMessage, password [, algorithm [, iterations]])

Decrypts a base64-encoded ciphertext. The salt is extracted from the ciphertext automatically.

jasypt.decrypt('nsbC5r0ymz740/aURtuRWw==', 'secret');
// => 'admin'

Throws an error if the password is wrong or the ciphertext is corrupted.

jasypt.digest(message [, salt [, iterations [, algorithm]]])

Produces a one-way hash. Returns base64-encoded salt + digest bytes.

const hash = jasypt.digest('admin');

jasypt.matches(message, storedDigest [, salt [, iterations [, algorithm]]])

Verifies a plaintext message against a stored digest. Uses constant-time comparison.

const hash = jasypt.digest('admin');
jasypt.matches('admin', hash);  // => true
jasypt.matches('wrong', hash);  // => false

Encryptor

Low-level class for direct control over encryption parameters.

import Jasypt from '@alt-javascript/jasypt';
const { Encryptor } = Jasypt;

const enc = new Encryptor({
  password: 'secret',
  algorithm: 'PBEWITHHMACSHA256ANDAES_256',
  iterations: 2000,
});

const ciphertext = enc.encrypt('admin', 'secret');
const plaintext  = enc.decrypt(ciphertext, 'secret');

Digester

Low-level class for direct control over digest parameters.

import Jasypt from '@alt-javascript/jasypt';
const { Digester } = Jasypt;

const dig = new Digester({ algorithm: 'SHA-512' });
dig.setIterations(5000);
dig.setSaltSize(16);

const hash    = dig.digest('admin');
const isMatch = dig.matches('admin', hash); // => true

CLI

Usage: jasypt [options] [command]

Commands:
  encrypt|enc <msg>            Encrypt a plaintext message
  decrypt|dec <msg>            Decrypt an encrypted message
  digest|dig <msg>             One-way digest (hash) a message
  matches|match <msg> <stored> Verify a message against a stored digest

Options:
  -v, --version  Output the version number
  -h, --help     Output usage information

Encrypt and Decrypt

jasypt encrypt -p mySecretKey admin
# => nsbC5r0ymz740/aURtuRWw==

jasypt decrypt -p mySecretKey nsbC5r0ymz740/aURtuRWw==
# => admin

# Use a different algorithm
jasypt encrypt -p mySecretKey -a PBEWITHHMACSHA256ANDAES_256 admin

Option	Default	Description
-p, --password <pwd>		Secret key (required)
-a, --algorithm <algo>	PBEWITHMD5ANDDES	Encryption algorithm

Digest and Verify

jasypt digest admin
# => base64-encoded hash

jasypt matches admin 'stored-hash-here'
# => true or false

# Custom algorithm, iterations, and salt size
jasypt digest -a SHA-512 -i 500 -s 16 admin

Option	Default	Description
-a, --algorithm <algo>	SHA-256	Digest algorithm
-i, --iterations <n>	1000	Hash iterations
-s, --salt-size <n>	8	Salt size in bytes

Supported Algorithms

Encryption

Algorithm	Type	Description
PBEWITHMD5ANDDES	PBE1	MD5 KDF + DES-CBC (default)
PBEWITHMD5ANDTRIPLEDES	PBE1	MD5 KDF + 3DES-CBC
PBEWITHSHA1ANDDESEDE	PBE1	SHA-1 KDF + 3DES-CBC
PBEWITHSHA1ANDRC2_128	PBE1	SHA-1 KDF + RC2-CBC 128-bit
PBEWITHSHA1ANDRC2_40	PBE1	SHA-1 KDF + RC2-CBC 40-bit
PBEWITHSHA1ANDRC4_128	PBE1	SHA-1 KDF + RC4 128-bit
PBEWITHSHA1ANDRC4_40	PBE1	SHA-1 KDF + RC4 40-bit
PBEWITHHMACSHA1ANDAES_128	PBE2	PBKDF2-SHA1 + AES-128-CBC
PBEWITHHMACSHA1ANDAES_256	PBE2	PBKDF2-SHA1 + AES-256-CBC
PBEWITHHMACSHA224ANDAES_128	PBE2	PBKDF2-SHA224 + AES-128-CBC
PBEWITHHMACSHA224ANDAES_256	PBE2	PBKDF2-SHA224 + AES-256-CBC
PBEWITHHMACSHA256ANDAES_128	PBE2	PBKDF2-SHA256 + AES-128-CBC
PBEWITHHMACSHA256ANDAES_256	PBE2	PBKDF2-SHA256 + AES-256-CBC
PBEWITHHMACSHA384ANDAES_128	PBE2	PBKDF2-SHA384 + AES-128-CBC
PBEWITHHMACSHA384ANDAES_256	PBE2	PBKDF2-SHA384 + AES-256-CBC
PBEWITHHMACSHA512ANDAES_128	PBE2	PBKDF2-SHA512 + AES-128-CBC
PBEWITHHMACSHA512ANDAES_256	PBE2	PBKDF2-SHA512 + AES-256-CBC
PBEWITHHMACSHA512/224ANDAES_128	PBE2	PBKDF2-SHA512/224 + AES-128-CBC
PBEWITHHMACSHA512/224ANDAES_256	PBE2	PBKDF2-SHA512/224 + AES-256-CBC
PBEWITHHMACSHA512/256ANDAES_128	PBE2	PBKDF2-SHA512/256 + AES-128-CBC
PBEWITHHMACSHA512/256ANDAES_256	PBE2	PBKDF2-SHA512/256 + AES-256-CBC

PBE1 algorithms use an iterative MD5/SHA-1 KDF (EVP_BytesToKey-style) with an 8-byte salt. RC2 and RC4 variants require the OpenSSL legacy provider.

PBE2 algorithms use PBKDF2 with a 16-byte salt and a random 16-byte IV stored alongside the ciphertext.

Digest

Algorithm	Notes
MD5
SHA-1
SHA-224
SHA-256	Default
SHA-384
SHA-512
SHA-512/224
SHA-512/256
SHA3-224
SHA3-256
SHA3-384
SHA3-512
MD2	Requires OpenSSL legacy provider

Digester.SUPPORTED_ALGORITHMS reflects only algorithms available in the current OpenSSL build.

Acknowledgements

This project is a fork of jasypt by Ricky, updated for Node.js 18+ (OpenSSL 3.0 compatibility), with additional algorithms, digest support, and an improved CLI.

License

MIT