I need to generate a RSA key pair with Javascript. This key pair will be used for encrypting a one time blob of data (20-100kb), then discarded. This data can be reduced to a couple of hundred kb or less if I only encrypt data that needs to be secure and not other resources such as image files for the application.

Should I write my own implementation or are there any libraries that I can trust to be both stable and secure?

  • 4
    Definitely do not write your own implementation. Just don't. Better to redesign your whole application, than to write your own implementation...
    – AviD
    Commented Jul 26, 2011 at 5:40

3 Answers 3


You could take a look at the GWT Crypto package. Its a port of some of the BouncyCastle stuff into GWT, so you should be able to take the compiled output and massage it a bit so you can call it from your current Javascript. It currently supports RSA keypair generation and encryption/decryption, as well as AES and DES. I think that's about it though.

I personally have not used this library, but since it was ported from BC it should be safer than writing your own implementation. That said, I dont know where they sourced their SecureRandom implementation from. You may need to look to see if its actually a cryptographically secure implementation or not. I took a quick look and they are just doing something with SHA and the seed bytes, but I dont know if that qualifies or not.

One last thing. I have found using RSA to encrypt large amounts of data to be quite slow. Perhaps you may want to use a hybrid solution of some sort where you encrypt an AES256 key using the RSA keypair and then use AES to encrypt the data? Could be faster...

  • I can change my code to just encrypt the parts of the package that differ between clients (ie. the secure stuff). How do I know BouncyCastle is secure?
    – Casebash
    Commented Jul 26, 2011 at 5:00
  • Aside from paying someone you trust to inspect it? I suppose you dont. However, BouncyCastle is the crypto provider in Google's Android. Perhaps if its good enough for them its good enough for you? That's really a tough question and I dont know what right answer is. As far as I know it doesnt have any government certifications or anything...
    – senecaso
    Commented Jul 26, 2011 at 5:13
  • It appears that the Google Web Toolkit is not really designed to support this use case: -groups.google.com/forum/#!topic/google-web-toolkit/2a6HnMJJ0ss. I could use GWT Exporter, but I think its best just to find a javascript library
    – Casebash
    Commented Jul 27, 2011 at 5:38
  • Ya, like I said, you would have to "massage" the output. Still, its almost certainly safer than implementing your own! :) You could try jscryptolib, but I dont know how trusted it is, not to mention there hasnt been any activity on the project for ~2yrs. The other implementations that come up with a google search seem to be personal/student projects, so I dont know how much faith should be put into them being correct.
    – senecaso
    Commented Jul 27, 2011 at 6:26
  • new GWTO Crypto Link
    – Fed
    Commented Nov 27, 2017 at 23:11

Check the jsencrypt project. If you use nodejs I recommend node-rsa module.


You should really avoid doing cryptography in javascript. The short reason is because you cannot trust a javascript program. The long answer can be found here:

Even if you web application is written to be secure against XSS, CSRF, etc. attacks, javascript is run in a virtual machine with no proof of security. The javascript JIT compiler might introduce shortcuts in the code and thus render it be vulnerable to timing attacks.

If you need to encrypt the transmission of data, you should use TLS. If you need to encrypt stored data, you should use a good symmetric algorithm (such as AES 256 in GCM mode).

If you want a better answer, I suggest you to tell us why you think you need RSA. What problem you want to solve with it? Maybe RSA (in javascript or not) is not the best solution (or not even a good one).

  • Can you at least summarize why you "can't trust a Javascript program"?
    – schroeder
    Commented Sep 10, 2014 at 14:38
  • Somehow, I don't think he'll answer your question, 3+ years after he sought help. Commented Sep 10, 2014 at 15:27
  • @schoreder I added an example. There is so many ways to attack a javascript code, I'm not sure it can be summarized. Commented Sep 10, 2014 at 15:28
  • @ChrisMurray I saw it afterwards. Commented Sep 10, 2014 at 15:32
  • Sometimes you might be doing cryptography in JavaScript to satisfy a certain protocol, not because you need additional security. For example, if a service requires a RSA key pair but you already have communication set up via TLS–this isn't really a security thing anymore, but a "I need to generate a keypair in JavaScript".
    – saagarjha
    Commented Jan 25, 2021 at 0:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .