v150 · Web Cryptography

ChaCha20-Poly1305 AEAD

A fast, constant-time authenticated cipher (RFC 8439) that doesn't need AES hardware acceleration. Encrypt a message with a 12-byte nonce and optional additional-authenticated-data; the Poly1305 tag protects both the ciphertext and the AAD. Tamper with either and decryption fails — and a wrong-length nonce throws a real OperationError.

Enter a message and encrypt it.

Nonce (12 random bytes) — sent alongside the ciphertext

—

Ciphertext + 16-byte Poly1305 tag

—

Decryption result

not decrypted

—
const key = await crypto.subtle.generateKey(
  { name: "ChaCha20-Poly1305" }, true, ["encrypt", "decrypt"]);

const nonce = crypto.getRandomValues(new Uint8Array(12)); // must be 12 bytes
const params = {
  name: "ChaCha20-Poly1305",
  iv: nonce,
  additionalData: new TextEncoder().encode("msg-id:8842"),
};

const ct = await crypto.subtle.encrypt(params, key,
  new TextEncoder().encode("Meet at the old pier, midnight."));

// Same nonce + same AAD required to decrypt; any change throws OperationError
const pt = await crypto.subtle.decrypt(params, key, ct);

see also

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗