Node.js Crypto Module

What Is the Crypto Module?

crypto is a core Node.js module built on top of OpenSSL, providing utilities for hashing, encryption, HMACs, digital signatures, and secure random number generation. It requires no installation - you simply require('crypto') and start using it. This lesson focuses on two of its most common use cases: creating one-way hashes with createHash() and generating cryptographically strong random values with randomBytes().

Hashing Data with createHash

A hash function takes an input of any size and produces a fixed-size output, called a digest, that acts like a fingerprint of the data. The same input always produces the same digest, but even a tiny change to the input produces a completely different one. This makes hashing useful for verifying file integrity, detecting duplicate content, and building checksums.

const crypto = require('crypto');

const hash = crypto.createHash('sha256')
  .update('hello world')
  .digest('hex');

console.log(hash);
// b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde

You are not limited to a single call to update(). For large inputs, such as a file being streamed in chunks, you can call update() repeatedly before finally calling digest() once to get the combined result.

const crypto = require('crypto');

const hash = crypto.createHash('sha256');
hash.update('first chunk of data ');
hash.update('second chunk of data');

console.log(hash.digest('hex'));
// digest reflects both chunks combined, as if they were one string

Generating Random Bytes

crypto.randomBytes() generates cryptographically strong pseudo-random data, unlike Math.random(), which is predictable enough that it should never be used for tokens, session IDs, or password reset links. randomBytes() can be called asynchronously with a callback, or synchronously by omitting the callback.

const crypto = require('crypto');

// Asynchronous version
crypto.randomBytes(16, (err, buf) => {
  if (err) throw err;
  console.log(buf.toString('hex')); // e.g. "3f7a9c2e8b1d4f605a2c9e8d7b6a5f43"
});

// Synchronous version, useful for a quick one-off token
const token = crypto.randomBytes(8).toString('hex');
console.log(token);

Choosing a Hash Algorithm