@panva/hpke is a JavaScript module for Hybrid Public Key Encryption (HPKE). This module is designed to work across various Web-interoperable runtimes including Node.js, browsers, Cloudflare Workers, Deno, Bun, and others.

Support from the community to continue maintaining and improving this module is welcome. If you find this module useful, please consider supporting this project by becoming a sponsor.

@panva/hpke has no dependencies and it exports tree-shakeable ESM.

@panva/hpke is distributed via npmjs.com, jsdelivr.com, and github.com.

import * as HPKE from '@panva/hpke'

// 1. Choose a cipher suite
const suite = new HPKE.CipherSuite(
  HPKE.KEM_DHKEM_P256_HKDF_SHA256,
  HPKE.KDF_HKDF_SHA256,
  HPKE.AEAD_AES_128_GCM,
)

// 2. Generate recipient key pair
const recipient = await suite.GenerateKeyPair()

// 3. Encrypt a message
const plaintext = new TextEncoder().encode('Hello, World!')
const { encapsulatedKey, ciphertext } = await suite.Seal(recipient.publicKey, plaintext)

// 4. Decrypt the message
const decrypted = await suite.Open(recipient.privateKey, encapsulatedKey, ciphertext)
console.log(new TextDecoder().decode(decrypted)) // "Hello, World!"

For more advanced examples, including how to integrate external cryptographic libraries, see the examples directory.

This module is compatible with JavaScript runtimes that support the utilized Web API globals and standard built-in objects or are Node.js.

The following runtimes are supported (this is not an exhaustive list):

• Bun
• Browsers
• Cloudflare Workers
• Deno
• Electron
• Node.js

Please note that some suites may not be available depending on the runtime used.

Algorithm implementations exposed by this module are built on top of Web Cryptography (and its extensions, e.g. Secure Curves, Modern Algorithms). Runtimes implementing Web Cryptography are not required to support all of its algorithms and so not all algorithms are available in all runtimes, see

This module is designed to be extensible, you can bring outside-built implementations of any KEM, KDF, or AEAD algorithm into any JavaScript runtime by conforming to the respective interfaces (KEM, KDF, or AEAD). This allows you to use alternative cryptographic libraries, native bindings, or specialized hardware implementations alongside the built-in Web Cryptography-based algorithms.

For extended algorithm support across all runtimes, see @panva/hpke-noble, which provides additional KEM, KDF, and AEAD implementations using Paul Miller's @noble cryptographic libraries. These implementations can be freely mixed and matched with the built-in algorithms.

Below are the algorithms built in (based on Web Cryptography) and their runtime support matrix.