cdn - xero/leviathan-crypto GitHub Wiki
leviathan-crypto is published to npm and mirrored on unpkg. All WasmSource types work directly from the CDN with no install or bundler required.
Import the embedded blobs alongside the main library. WASM is baked into the JS as gzip+base64, so there are no extra network requests beyond the module files themselves.
<script type="module">
import { init, Seal, SerpentCipher } from 'https://unpkg.com/[email protected]/dist/index.js'
import { serpentWasm } from 'https://unpkg.com/[email protected]/dist/serpent/embedded.js'
import { sha2Wasm } from 'https://unpkg.com/[email protected]/dist/sha2/embedded.js'
await init({ serpent: serpentWasm, sha2: sha2Wasm })
const key = SerpentCipher.keygen()
const blob = Seal.encrypt(SerpentCipher, key, new TextEncoder().encode('hello from the browser'))
const decrypted = Seal.decrypt(SerpentCipher, key, blob)
console.log(new TextDecoder().decode(decrypted))
</script>Subpath imports also work with full URLs:
<script type="module">
import { serpentInit, SerpentCipher } from 'https://unpkg.com/[email protected]/dist/serpent/index.js'
import { serpentWasm } from 'https://unpkg.com/[email protected]/dist/serpent/embedded.js'
await serpentInit(serpentWasm)
// ...
</script>Pass a URL pointing at the .wasm file on the CDN. The browser uses
WebAssembly.compileStreaming to compile the binary while it downloads.
<script type="module">
import { init, SHA256 } from 'https://unpkg.com/[email protected]/dist/index.js'
await init({
sha2: new URL('https://unpkg.com/[email protected]/dist/sha2.wasm')
})
const sha = new SHA256()
const digest = sha.hash(new TextEncoder().encode('hello'))
console.log(digest)
sha.dispose()
</script>The server must respond with Content-Type: application/wasm.
WASM filenames by module:
| Module | File |
|---|---|
serpent |
serpent.wasm |
chacha20 |
chacha20.wasm |
sha2 |
sha2.wasm |
sha3 |
sha3.wasm |
Fetch the WASM binary yourself and pass the ArrayBuffer directly. Useful when
you want to cache the binary, load from a custom endpoint, or verify integrity
before instantiation.
<script type="module">
import { init, Seal, XChaCha20Cipher } from 'https://unpkg.com/[email protected]/dist/index.js'
import { sha2Wasm } from 'https://unpkg.com/[email protected]/dist/sha2/embedded.js'
const res = await fetch('https://unpkg.com/[email protected]/dist/chacha20.wasm', {
// integrity hash is version-specific, update when upgrading
integrity: 'sha384-...'
})
const binary = new Uint8Array(await res.arrayBuffer())
await init({ chacha20: binary, sha2: sha2Wasm })
const key = XChaCha20Cipher.keygen()
const blob = Seal.encrypt(XChaCha20Cipher, key, new TextEncoder().encode('manual mode'))
const plaintext = Seal.decrypt(XChaCha20Cipher, key, blob)
console.log(new TextDecoder().decode(plaintext))
</script>Tip
The integrity option is standard SRI (Subresource Integrity).
The browser verifies the hash before resolving the response, and throws a network error if it doesn't match.
Browsers don't read package.json exports, so bare specifiers like
import { init } from 'leviathan-crypto' don't work without an import map.
If you want the same import style as the npm docs, add one before your module scripts:
<script type="importmap">
{
"imports": {
"leviathan-crypto": "https://unpkg.com/[email protected]/dist/index.js",
"leviathan-crypto/serpent": "https://unpkg.com/[email protected]/dist/serpent/index.js",
"leviathan-crypto/serpent/embedded": "https://unpkg.com/[email protected]/dist/serpent/embedded.js",
"leviathan-crypto/chacha20": "https://unpkg.com/[email protected]/dist/chacha20/index.js",
"leviathan-crypto/chacha20/embedded": "https://unpkg.com/[email protected]/dist/chacha20/embedded.js",
"leviathan-crypto/sha2": "https://unpkg.com/[email protected]/dist/sha2/index.js",
"leviathan-crypto/sha2/embedded": "https://unpkg.com/[email protected]/dist/sha2/embedded.js",
"leviathan-crypto/sha3": "https://unpkg.com/[email protected]/dist/sha3/index.js",
"leviathan-crypto/sha3/embedded": "https://unpkg.com/[email protected]/dist/sha3/embedded.js",
"leviathan-crypto/stream": "https://unpkg.com/[email protected]/dist/stream/index.js"
}
}
</script>
<script type="module">
import { init, Seal, SerpentCipher } from 'leviathan-crypto'
import { serpentWasm } from 'leviathan-crypto/serpent/embedded'
import { sha2Wasm } from 'leviathan-crypto/sha2/embedded'
// identical to the npm usage docs from here
</script>Important
The import map must appear before any <script type="module"> that uses bare
specifiers. Import maps are supported in all modern browsers
(Chrome 89+, Firefox 108+, Safari 16.4+).
| Document | Description |
|---|---|
| index | Project Documentation index |
| architecture | architecture overview, module relationships, buffer layouts, and build pipeline |
| lexicon | Glossary of cryptographic terms |
| examples | Code examples for every primitive |
