Lock & Key: A Developer’s Guide to Encryption and Decryption in JavaScript

In a world where data is the new oil, encryption is the refinery.

Whether you're building a simple login form or a full-fledged fintech platform, data security is non-negotiable. With JavaScript being the language of the web, understanding how to encrypt and decrypt sensitive data on the client side (or even server side in Node.js) is essential for any developer.

🧠 Understanding the Basics

🔐 What is Encryption?
Encryption is the process of converting plain text into a coded format (cipher text) to prevent unauthorized access. Only someone with the decryption key can turn it back into readable text.

🧪 What is Decryption?
Decryption is the process of converting the cipher text back to plain text using a key or password.

🧰 Encryption Methods in JavaScript

1. 🧂 Base64 Encoding (Not Secure for Confidential Data)
This is not true encryption, but often mistaken as one. It is an encoding mechanism and can easily be reversed.

const data = "Hello World!";
const encoded = btoa(data); // Encrypt
const decoded = atob(encoded); // Decrypt

Use-case: Safely transmitting non-sensitive data in URLs or HTTP headers.

2. 🔐 AES (Advanced Encryption Standard) with CryptoJS
CryptoJS is one of the most popular JavaScript libraries for cryptography.

Installation:

npm install crypto-js

Encryption & Decryption Example:

const CryptoJS = require("crypto-js");

const secretKey = "my-secret-key";
const message = "Encrypt this message";

// Encrypt
const encrypted = CryptoJS.AES.encrypt(message, secretKey).toString();

// Decrypt
const bytes = CryptoJS.AES.decrypt(encrypted, secretKey);
const originalText = bytes.toString(CryptoJS.enc.Utf8);

console.log(originalText); // Encrypt this message

Use-case: Encrypting data stored in localStorage, cookies, or frontend apps.

3. 🔑 RSA Encryption (Public/Private Key Pair) with Node.js
RSA is commonly used for secure key exchange and digital signatures.
You can use the node-forge or crypto module (built-in in Node.js).

Example using node-forge:

npm install node-forge

const forge = require('node-forge');
const { publicKey, privateKey } = forge.pki.rsa.generateKeyPair(2048);

const message = "Hello RSA";

// Encrypt with public key
const encrypted = publicKey.encrypt(message, 'RSA-OAEP');

// Decrypt with private key
const decrypted = privateKey.decrypt(encrypted, 'RSA-OAEP');

console.log(decrypted); // Hello RSA

Use-case: Secure messaging, digital identity, verifying software integrity.

4. 🛡️ Web Crypto API (Browser-native)
Modern browsers come with a powerful, asynchronous Web Crypto API.

// Generate a key
const key = await crypto.subtle.generateKey(
  {
    name: "AES-GCM",
    length: 256
  },
  true,
  ["encrypt", "decrypt"]
);

// Convert text to Uint8Array
const encoder = new TextEncoder();
const data = encoder.encode("Secure message");

// Encrypt
const iv = crypto.getRandomValues(new Uint8Array(12));
const encrypted = await crypto.subtle.encrypt(
  {
    name: "AES-GCM",
    iv
  },
  key,
  data
);

// Decrypt
const decrypted = await crypto.subtle.decrypt(
  {
    name: "AES-GCM",
    iv
  },
  key,
  encrypted
);

const decoder = new TextDecoder();
console.log(decoder.decode(decrypted)); // Secure message

Use-case: Native browser apps, PWA security, file encryption.

5. 🪄 Custom Hashing (SHA256, MD5, etc.)
For password hashing, you don’t encrypt — you hash.

const CryptoJS = require("crypto-js");
const hashed = CryptoJS.SHA256("mypassword").toString();

console.log(hashed); // e.g., "f7c3bc1d808e04732adf679965ccc34ca7ae3441"

Use-case: Passwords, file integrity checks.
Remember: Hashes can't be reversed, only verified.

🧨 Common Mistakes to Avoid:
❌ Storing keys in source code.
❌ Using Base64 for secure encryption.
❌ Not using IVs or salts with AES.
❌ Failing to handle errors in encryption/decryption.
❌ Using outdated libraries (always check for updates).

🧠 Final Thoughts:
JavaScript offers several powerful options for encryption and decryption — but with great power comes great responsibility. While client-side encryption is useful, never rely on it alone. Always complement it with secure backend validation, HTTPS, and server-side encryption for a complete security strategy.

🔏 Your app is only as secure as its weakest cryptographic link.

If you found this article helpful, don’t forget to clap, bookmark, and share. Have questions or want a follow-up post on storing encrypted data in databases or local Storage? Drop a comment below!

Happy Coding!!😊