Dismiss Notice
Join Physics Forums Today!
The friendliest, high quality science and math community on the planet! Everyone who loves science is here!

JavaScript Is JavaScript encryption still secure ?

  1. May 4, 2013 #1
    JavaScrypt is an encryption program [ 256AES ?] released in 2005 ...


    Is this still a secure method of encryption ? ,
    an example of an encrypted messages is below, [ the key is a 64 character hexadecimal number ]

    ##### Encrypted: decrypt with www.fourmilab.ch/javascrypt/javascrypt.html
    ##### End encrypted message

    A bruteforce crack allegedly would take trillions of centuries ... https://www.grc.com/haystack.htm
    Last edited: May 4, 2013
  2. jcsd
  3. May 4, 2013 #2

    jim mcnamara

    User Avatar

    Staff: Mentor

    The short, and probably not what you want, answer: Yes but it depends.

    Important points:
    1. Security is NOT encryption. Encryption is a small part of overall security. Security is very multi-faceted, and depends on lots of layers to be effective.
    2. Do not confuse time to decrypt with anything more than a means to scare off the script kiddie attacks. Time to decrypt simply forces some wannabe hacker to go on to another site, for example.
    3. If you expect encryption alone to deter a well-funded government agency from most countries, think again.

    The site you link to about bruteforce attack, explains the other depends. If you have an 8 byte, diverse character-space password the straight bruteforce attack duration is determined by the number of characters. 16 bytes takes longer to bruteforce. The idea behind the web site - make your password secure enough so the bad guys will go away, and choose some very easily hackable system.

    Before you entrust your life's savings to some encryption based security scheme go to Bruce Schnier's site. He has a bunch of articles.


    IT Management, usually non-technical folks, ask questions like this all the time. So you asked a good question, keep working on it.
    Last edited: May 4, 2013
  4. May 5, 2013 #3

    I was looking for a method to store encrypted passwords in away that could be decrypted on any computer OS, (Windows/Linux/Mac), and JavaScrypt seemed to offer that, provided it had an internet browser with JavaScript. The encryption need only be sufficient enough to prevent criminal element from helping themselves to my bank account, rather than defeat the FBI.

    Online banking uses 256bit encryption , so on the face of it JavaScrypt (AES256) appears to be as least as strong for the same key length.

    BTW the key for the encrypted message in the first post is the hexadecimal number (not “text”) below … 1BF5427B1DEB40557B05276D27CC801DD9C500D87441C8B7DF159575D2D851D0
    Last edited: May 5, 2013
  5. May 26, 2013 #4


    User Avatar
    Gold Member

    Basic misunderstand is going on here. "Encrypted passwords" are never unencrypted. They are encrypted with one-way encryption the first time the password is entered, then the encrypted form is stored. This is so that people cannot just break into the password database and steal your password. (It's actually more complex than that, as passwords get "salted" as well as encrypted--Google it).

    To use an encrypted password, you need to have the same one-way encryption algorithm, encrypt the received password (which should have come to you via an already-secure transmission medium), and then retrieve the encrypted STORED password and compared the just-encrypted recently-entered password.

    I have no idea whether JavaScrypt software does a good job of this or not, but was concerned about the phrase "in a way that could be decrypted" because it indicates a basic misunderstanding of how encrypted passwords need to be handled.
  6. May 27, 2013 #5


    User Avatar
    Gold Member

    If you're storing passwords, use something like bcrypt.

    Using JavaScript (the language) for encryption is generally frowned upon in the security community (though there is some argument on this point). Browsers are generally insecure and it's too easy to modify code that is run on the client.

    What exactly do you hope to accomplish, and what is your threat model?
    Last edited: May 27, 2013
Share this great discussion with others via Reddit, Google+, Twitter, or Facebook