Crypto Module in Node.js : Hashing and Encryption Guide

Learn how to use the Node.js Crypto module for hashing, encryption, decryption, random token generation, and security with practical examples.

Node.js Crypto Module Explained: Hashing, Encryption, and Security Basics

Security is one of the most important aspects of backend development.

Whenever you log into an application, reset a password, verify a token, or store sensitive information, cryptography is working behind the scenes.

Node.js provides a powerful built-in module called Crypto that allows developers to perform hashing, encryption, decryption, random value generation, and digital signatures without installing external libraries.

In this guide, you'll learn how the Node.js Crypto module works and how it is used in real-world applications.

Prerequisites

Before reading this guide, you should understand:

• Node.js Buffers
• Node.js Worker Threads
• Node.js Process Object

What Is the Crypto Module?

The Crypto ( crypto ) module is a built-in Node.js module for performing cryptographic operations.

Import it like this:

  const crypto = require("crypto");
  

Because it's built into Node.js, no installation is required.

Why Use the Crypto Module?

The Crypto module allows you to:

• Hash passwords
• Generate secure random values
• Encrypt sensitive information
• Decrypt encrypted data
• Create digital signatures
• Verify data integrity

These operations form the foundation of secure applications.

Hashing Data

Hashing converts data into a fixed-length value.

Example:

  const crypto = require("crypto");

const hash = crypto
  .createHash("sha256")
  .update("Hello Node.js")
  .digest("hex");

console.log(hash);
  

Output:

  0a9d...
  

Hashing is one-way, meaning it cannot be reversed.

Password Hashing

A common use case is storing passwords securely.

  const crypto = require("crypto");

const password = "mySecretPassword";

const hashedPassword = crypto
  .createHash("sha256")
  .update(password)
  .digest("hex");

console.log(hashedPassword);
  

In production applications, libraries such as bcrypt or argon2 are generally preferred for password storage.

Generating Random Values

Secure random values are essential for tokens and API keys.

  const crypto = require("crypto");

const token = crypto.randomBytes(32).toString("hex");

console.log(token);
  

Example output:

  a3f4b9...
  

Encrypting Data

  const crypto = require("crypto");

const algorithm = "aes-256-cbc";
const key = crypto.randomBytes(32);
const iv = crypto.randomBytes(16);

const cipher = crypto.createCipheriv(
  algorithm,
  key,
  iv
);

let encrypted = cipher.update(
  "Secret Message",
  "utf8",
  "hex"
);

encrypted += cipher.final("hex");

console.log(encrypted);
  

Decrypting Data

  const decipher = crypto.createDecipheriv(
  algorithm,
  key,
  iv
);

let decrypted = decipher.update(
  encrypted,
  "hex",
  "utf8"
);

decrypted += decipher.final("utf8");

console.log(decrypted);
  

Output:

  Secret Message
  

Common Crypto Methods

These methods cover most common use cases.

Real-World Use Cases

The Crypto module is used for:

• Password hashing
• API key generation
• JWT signing
• Secure cookies
• Encryption
• File integrity checks
• Payment verification
• Digital signatures

Nearly every production backend application uses cryptography in some form.

Common Beginner Mistakes

Storing Plain Text Passwords

Never store passwords directly in the database.

Always hash them.

Using SHA256 for Password Storage

For passwords, prefer:

• bcrypt
• argon2
• scrypt

These algorithms are designed specifically for password security.

Hardcoding Encryption Keys

Keys should always be stored in environment variables.

Best Practices

• Use secure random generators.
• Store secrets in environment variables.
• Rotate encryption keys periodically.
• Use proven algorithms.
• Prefer bcrypt or argon2 for passwords.

Production Tip

CPU-intensive cryptographic operations can block the Event Loop.

Large-scale applications often perform encryption tasks inside Worker Threads to improve responsiveness.

Why the Crypto Module Matters

The Crypto module is the foundation of application security.

Without cryptography, secure authentication, authorization, payments, and data protection would not be possible.

Conclusion

The Node.js Crypto module provides powerful tools for hashing, encryption, and secure random value generation.

By understanding these concepts, you'll be able to build safer and more secure backend applications.