{"id":18841612,"url":"https://github.com/webview-crypto/webview-crypto","last_synced_at":"2026-01-07T13:24:13.702Z","repository":{"id":43133525,"uuid":"65750605","full_name":"webview-crypto/webview-crypto","owner":"webview-crypto","description":"Access the Web Cryptography API with a WebView","archived":false,"fork":false,"pushed_at":"2022-12-09T10:38:37.000Z","size":350,"stargazers_count":12,"open_issues_count":11,"forks_count":17,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-09-04T12:59:34.536Z","etag":null,"topics":["javascript","web-cryptography","webview"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/webview-crypto.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2016-08-15T17:19:29.000Z","updated_at":"2025-04-09T18:59:23.000Z","dependencies_parsed_at":"2023-01-25T21:01:26.245Z","dependency_job_id":null,"html_url":"https://github.com/webview-crypto/webview-crypto","commit_stats":null,"previous_names":["saulshanabrook/webview-crypto"],"tags_count":16,"template":false,"template_full_name":null,"purl":"pkg:github/webview-crypto/webview-crypto","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/webview-crypto%2Fwebview-crypto","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/webview-crypto%2Fwebview-crypto/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/webview-crypto%2Fwebview-crypto/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/webview-crypto%2Fwebview-crypto/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/webview-crypto","download_url":"https://codeload.github.com/webview-crypto/webview-crypto/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/webview-crypto%2Fwebview-crypto/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":279009390,"owners_count":26084581,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-11T02:00:06.511Z","response_time":55,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["javascript","web-cryptography","webview"],"created_at":"2024-11-08T02:51:52.174Z","updated_at":"2026-01-07T13:24:13.683Z","avatar_url":"https://github.com/webview-crypto.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# webview-crypto\n\n[![npm](https://img.shields.io/npm/v/webview-crypto.svg?maxAge=2592000?style=flat-square)](https://www.npmjs.com/package/webview-crypto)\n\nThis repo provides some helper tools to run the [Web Cryptography API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API)\nin a WebView.\n\nIt is used in\n[`react-native-webview-crypto`](https://github.com/saulshanabrook/react-native-webview-crypto),\n[`nativescript-webview-crypto`](https://github.com/saulshanabrook/nativescript-webview-crypto), and\n[`nativescript-angular-webview-crypto`](https://github.com/saulshanabrook/nativescript-angular-webview-crypto). It is not meant to be used directly, but simply serves as a common building\nblock for those libraries.\n\n\n## Why?\n\nThe [Web Cryptography API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API)\nis [implemented in all major browsers](http://caniuse.com/#feat=cryptography)\nand provides performant and secure way of doing client side encryption in\nJavaScript. However it is not supported in NativeScript or React Native, which\nlimits them from using Javascript libraries that depend on Web Crypto.\n\nLuckily, the iOS and Android browser engines do support this API.\nWe can use their implementations by creating a WebView and communicating\nwith it asynchronously.\n\n## Usage\nWe provide two entrypoints in this repo.\n\n### Main Thread\n\n`MainWorker` is used in your main thread. It communicates to the WebView\nasynchronously with string messages, providing a `crypto` attribute\nthat fulfills the [`Crypto`](https://developer.mozilla.org/en-US/docs/Web/API/Crypto)\ninterface. If you set this to be globally defined, all applications that depend\non `window.crypto` will work transperently.\n\n```javascript\nimport {MainWorker} from \"webview-crypto\";\n\nfunction sendToWebView(message: string): void {\n  // sends `message` to the webview\n}\n\nvar mw = new MainWorker(sendToWebView); // optional second argument for debug on or off\n\n// call `mw.onWebViewMessage` whenever you get a message from the WebView\nonWebViewMessage(mv.onWebViewMessage.bind(mv));\n\nmw.crypto.subtle.generateKey(\n  // whatever\n)\n\nwindow.crypto = mw.crypto;\n```\n\n### WebView\n\n`WebViewWorkerSource` is a string that contains the source defining\na `WebViewWorker` constructor that should be used in your WebView.\n\nAfter loading that Javascript in the WebView, initialize\n`WebViewWorker` so that it can communicate with the main thread and do the\nwork of executing the cryptography.\n\n```javascript\n\nfunction sendToMain(message: string): void {\n  // send `message` to the main thread\n}\nvar wvw = new WebViewWorker(sendToMain);\n\n// call `wvw.onMainMessage` whenever you get a message from the main thread\nonMainMessage(wvw.onMainMessage.bind(wvw));\n```\n\n## Tests\n\nWe have some unit tests for basic behavior here.\nRun `npm run test:local` to run them in a local browser. You also need to run\n`npm run build:watch` to recompute the `webViewWorkerString` injected as needed.\n\nIn Travis CI, they run on iOS, Android, and Chrome through SauceLabs.\n\nWhile these tests do help catch some bugs, they do not provide any strong\nreassurance that this library will work in React Native and Typescript. That's\nbecause on those platforms, half the code is running in a WebView and the\nother half in their native JavaScript engine, which is either JavaScriptCore or\nV8. I haven't come up with a way to test this in an automated fashion.\n\nSo in addition to local unit tests, all code changes that might break something\nshould be tested against the example repos ([React Native](https://github.com/saulshanabrook/react-native-webview-crypto-example)\nand [NativeScript](https://github.com/saulshanabrook/nativescript-webview-crypto-example))\non both iOS and Android.\n\nI welcome suggestions on improving this process and making it more automated.\n\n## Caveats\nWhile this attempts to as stick to the Web Cryptography API as possible,\nthis is impossible in a few situations due to the differing browser\nimplementations.\n\n### Incomplete Support\nThis library is limited by the mobile browser's support. On iOS, the WebView's\nuse WebKit, which has limited and incomplete support ([example](https://bugs.webkit.org/show_bug.cgi?id=151308)).\nIf something isn't working, that might be why. Try it on Safari and see if it\nworks there.\n\n### `getRandomValues`\n\nSince this uses an asynchronous bridge to execute the crypto logic it\ncan't quite execute `crypto.getRandomValues` correctly, because that method\nreturns a value synchronously. It is simply *impossible* (as far as I know,\nplease let me know if there any ways to get around this) to wait for the\nbridge to respond asynchronously before returning a value.\n\nInstead, we add a `_promise` attribute to the `TypedArray` you passed in. This resolves\nwhen the `TypedArray` has been filled with random values. \n\nAlso, on all `crypto.subtle` methods that takes in\n`TypedArray`s, we will automatically wait for it to resolve. This means that if you \nare using the `TypedArray` in further cryptographic code, it will work transparently.\nSo hopefully existing code that uses the Web Cryptography API will continue to work \nwithout modification.\n\n### `CryptoKey`\nSince [JavaScriptCore](https://facebook.github.io/react-native/docs/javascript-environment.html#javascript-runtime)\ndoes not support `window.Crypto`, it also doesn't have a `CryptoKey` interface.\nSo instead of returning an actual `CryptoKey` from\n[`subtle.generateKey()`](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/generateKey)\nwe instead return an object that confirms to the `CryptoKey` interface and has\na `_import` property that has the value of the key exported as `jwk` or using\nthe value for importing the key. This allows\nyou to treat the `CryptoKey` as you would normally, and whenever you need to use\nit in some `subtle` method, we will automatically convert it back to a real\n`CryptoKey` from the `_import` string and the metadata.\n\n*This project was funded by [Burke Software and Consulting LLC](http://burkesoftware.com/) for [passit](http://passit.io/).*\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwebview-crypto%2Fwebview-crypto","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fwebview-crypto%2Fwebview-crypto","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwebview-crypto%2Fwebview-crypto/lists"}