[Replacement]: `pbkdf2`

[imcotton]

Package to replace

pbkdf2

Suggested replacement(s)

for require('pbkdf2')

• crypto.pbkdf2
• crypto.subtle.deriveBits({ name: 'PBKDF2' ... })
• import { pbkdf2Async } from '@noble/hashes/pbkdf2.js'

for require('pbkdf2').pbkdf2Sync

• crypto.pbkdf2Sync
• import { pbkdf2 } from '@noble/hashes/pbkdf2.js'

Manifest type

native (replaceable by a built-in platform feature)

Rationale

Version 3.1.2 was published 5 years ago (April 2021).

Version 3.1.3 was published 9 months ago (June 2025) with 1 bloat dependency to-buffer been added from this commit.

---

@noble/hashes is audited, 0 dependencies, 38m downloads / week.

Availability

• crypto.pbkdf2

  • Node.js v0.5.5

• crypto.pbkdf2Sync

  • Node.js v0.9.3

• crypto.subtle.deriveBits({ name: 'PBKDF2' ... })

  • Node.js v15
  • Web Crypto

Code example (optional)

[imcotton]

It is mostly native-supported features, except for doing pbkdf2Sync in the browser, which requires help from third-party dependencies. I'm not sure if this would disqualify it from the native category, suggestions are welcome.

[43081j]

if there's no particular reason to prefer noble over the native implementation, it does belong in the native manifest.

i think it makes sense 👍

[imcotton]

Yeah, given that the recommended number of iterations keeps increasing with advances in hardware, using pbkdf2Sync would be less realistic since it blocks the main thread. The pbkdf2 package's usage documentation also recommends using the async variant, which can use crypto.subtle when browserified.