pkijs.com

A pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, OID, PQC-first.

Every page in this reference is generated from the toolkit's own source comments. Zero npm runtime dependencies — the cryptography runs on Node's native node:crypto (classical and FIPS post-quantum), nothing vendored.

Quick start

npm install @blamejs/pki

var pki = require("@blamejs/pki");

var cert = pki.schema.x509.parse(pemText);
cert.subject.dn;                 // "CN=example.com, O=Example"
cert.validity.notAfter;          // Date
cert.signatureAlgorithm.name;    // "sha256WithRSAEncryption"

Design tenets

• Zero runtime dependencies. The published package's dependency object is empty; the cryptography is Node's own node:crypto.
• Fail closed. Every verify path throws; malformed input is a typed PkiError with a stable domain/reason code.
• Strict DER. The codec rejects every non-DER shape and enforces size and depth caps before it walks a byte.
• Post-quantum first. ML-DSA, ML-KEM, and SLH-DSA resolve through the same OID-keyed registry as the classical algorithms.
• Standards are the contract. Every structure maps to a named RFC, and a parser round-trips a valid input to identical bytes.

Namespaces