Verified libraries for recommended algorithms across 6 ecosystems. Filter by language or algorithm.
ringaead::AES_256_GCM. Hardware-accelerated. Minimal unsafe surface.
aes-gcmPure Rust with optional AES-NI. Part of the RustCrypto ecosystem.
cryptographycryptography.hazmat.primitives.ciphers.aead.AESGCM. Built on OpenSSL.
@noble/ciphersPure JS/TS AES-GCM. Audited. No native dependencies.
crypto.subtle.encrypt({name:'AES-GCM',...}). Native browser implementation.
cipher.NewGCM(block). Standard library. Hardware-accelerated.
AesGcm class. .NET 6+. Uses OS-level crypto provider.
Cipher.getInstance("AES/GCM/NoPadding"). Built into JDK.
sodiumoxideRust bindings to libsodium. secretbox/aead APIs.
chacha20poly1305XChaCha20Poly1305 type. Pure Rust, constant-time.
PyNaClnacl.secret.SecretBox (XSalsa20-Poly1305) or nacl.aead for XChaCha20. Wraps libsodium.
libsodium-wrapperscrypto_aead_xchacha20poly1305_ietf_encrypt. WASM build of libsodium.
golang.org/x/cryptochacha20poly1305.NewX() for XChaCha20. Official Go extended crypto.
Sodium.Core.NET bindings to libsodium. SecretAead.Encrypt.
org.bouncycastle:bcprov-jdk18onXChaCha20Poly1305 via BC lightweight API.
argon2Pure Rust Argon2id. Implements RFC 9106.
argon2-cffiWraps the C reference implementation. OWASP-recommended defaults.
argon2Node.js native binding to the C reference. Server-side only.
golang.org/x/cryptoargon2.IDKey(). Official Go extended crypto library.
Konscious.Security.Cryptography.Argon2Pure .NET Argon2id implementation.
org.bouncycastle:bcprov-jdk18onArgon2BytesGenerator class in BC lightweight API.
ed25519-dalekPart of the dalek ecosystem. Widely used in Rust crypto.
PyNaClnacl.signing.SigningKey. Wraps libsodium Ed25519.
cryptographyEd25519PrivateKey.generate(). Built on OpenSSL 3.x.
@noble/curvesed25519.sign/verify. Pure JS, audited, zero dependencies.
Standard library Ed25519. Used throughout Go ecosystem.
Not natively available before .NET 9 preview. Use Bouncy Castle or NSec.
org.bouncycastle:bcprov-jdk18onEd25519Signer class. Also available in JDK 15+ via EdDSA provider.
x25519-dalekEphemeralSecret + PublicKey. Part of the dalek ecosystem.
PyNaClnacl.public.Box for X25519 key agreement. Wraps libsodium.
@noble/curvesx25519.getSharedSecret(). Pure JS, audited.
golang.org/x/cryptocurve25519.X25519(). Official Go extended library.
NSec.CryptographyX25519 key agreement. Modern .NET crypto library.
org.bouncycastle:bcprov-jdk18onX25519Agreement class. Also in JDK 11+ via XDH.
hkdfHkdf::<Sha256>::new_from_prk(). Pure Rust.
cryptographycryptography.hazmat.primitives.kdf.hkdf.HKDF. Built on OpenSSL.
@noble/hasheshkdf(sha256, inputKey, salt, info, length). Pure JS, audited.
golang.org/x/cryptohkdf.New(sha256.New, secret, salt, info). Official Go crypto.
HKDF.DeriveKey(). .NET 5+.
org.bouncycastle:bcprov-jdk18onHKDFBytesGenerator class.
hmac.new(key, msg, hashlib.sha256). Python standard library.
@noble/hasheshmac(sha256, key, message). Pure JS, audited.
crypto.subtle.sign('HMAC', key, data). Native browser.
hmac.New(sha256.New, key). Standard library.
HMACSHA256 class. Built into .NET.
Mac.getInstance("HmacSHA256"). Built into JDK.
ml-kemFIPS 203 implementation. Pure Rust.
kyber-pyPure Python ML-KEM. Educational and testing use. [verify before use]
crystals-kyber-jsTypeScript ML-KEM implementation. [verify before use]
filippo.io/mlkem768By Go crypto team lead Filippo Valsorda. Clean API.
BouncyCastle.CryptographyML-KEM implementation in BC C# API.
org.bouncycastle:bcprov-jdk18onMLKEMKeyPairGenerator / MLKEMExtractor. BC 1.78+.
ml-dsaFIPS 204 implementation. Pure Rust.
dilithium-pyPure Python ML-DSA reference. [verify before use]
github.com/cloudflare/circlCloudflare's PQ crypto library. Dilithium/ML-DSA modes.
BouncyCastle.CryptographyML-DSA implementation in BC C# API.
org.bouncycastle:bcprov-jdk18onMLDSAKeyPairGenerator / MLDSASigner. BC 1.78+.