scrypt-js password key derivation: working versions (tested 2026-10-16)

{
  "name": "scrypt-js-kdf",
  "private": true,
  "type": "module",
  "scripts": {
    "test": "node --import tsx --test test/*.test.ts"
  },
  "dependencies": {
    "scrypt-js": "3.0.1"
  },
  "devDependencies": {
    "@types/node": "26.6.5",
    "tsx": "4.23.15"
  }
}

import scryptJs from "scrypt-js";

const { scrypt, syncScrypt } = scryptJs;

export type ScryptOptions = {
  N?: number;
  r?: number;
  p?: number;
  dkLen?: number;
};

const DEFAULTS: Required<ScryptOptions> = { N: 1024, r: 8, p: 1, dkLen: 32 };

export function toHex(bytes: Uint8Array): string {
  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
}

function encode(input: string): Uint8Array {
  return new TextEncoder().encode(input);
}

export function deriveKeySync(password: string, salt: string, options: ScryptOptions = {}): string {
  const { N, r, p, dkLen } = { ...DEFAULTS, ...options };
  return toHex(syncScrypt(encode(password), encode(salt), N, r, p, dkLen));
}

export async function deriveKey(password: string, salt: string, options: ScryptOptions = {}): Promise<string> {
  const { N, r, p, dkLen } = { ...DEFAULTS, ...options };
  return toHex(await scrypt(encode(password), encode(salt), N, r, p, dkLen));
}

import { test } from "node:test";
import assert from "node:assert/strict";
import { deriveKey, deriveKeySync } from "../src/kdf.ts";

const FAST = { N: 1024, r: 8, p: 1, dkLen: 32 } as const;
const SLOW = { N: 16384, r: 8, p: 1, dkLen: 64 } as const;

test("sync and async outputs are identical and deterministic", async () => {
  const sync = deriveKeySync("hunter2", "salt", FAST);
  assert.equal(sync, deriveKeySync("hunter2", "salt", FAST));
  assert.equal(sync, await deriveKey("hunter2", "salt", FAST));
  assert.match(sync, /^[0-9a-f]{64}$/);
});

test("different salts produce different keys", async () => {
  const a = await deriveKey("hunter2", "salt-a", FAST);
  const b = await deriveKey("hunter2", "salt-b", FAST);
  assert.notEqual(a, b);
});

test("higher cost params still return a stable hex key", async () => {
  const hex = deriveKeySync("password", "NaCl", SLOW);
  assert.match(hex, /^[0-9a-f]{128}$/);
  assert.equal(hex, deriveKeySync("password", "NaCl", SLOW));
  assert.equal(hex, await deriveKey("password", "NaCl", SLOW));
});

test("password changes the derived key", () => {
  const a = deriveKeySync("password-a", "NaCl", FAST);
  const b = deriveKeySync("password-b", "NaCl", FAST);
  assert.notEqual(a, b);
});