# Is cypher.js secure for sensitive data? [closed]

Is this library secure? Link to github repo

Here's his explanation:

Cypher does not encrypt through allocation based on mapping patterns. Cypher encryption process is completely mathematical and therefore, no pattern can be observed in the encrypted data result. Furthermore, Cypher encryption process result is not persistent, which means that encrypting a particular object with a particular key multiple times is highly unlikely to result in the same data - see demonstration below.

let data = "Cypher AAA", key = "_b7gBiG1oo";

console.log(data.encrypt(key)); // Possible OUTPUT: x%7~(yo~6}103V3I'Iv
console.log(data.encrypt(key)); // Possible OUTPUT: xMeqv|D~~21c1Z'oOw
console.log(data.encrypt(key)); // Possible OUTPUT: tmu~4~v|l^&X"~1I'|


I'm no expert in this field, but based on his description is seems like it can't be reversed or cracked.

• Don't trust them, I can see no where in their code is differential and linear analysis is defended from. Using WebCrypto with Base64 encoding gives much better security. Yet anoher example self-rolled snake oil crypto. – DannyNiu May 15 at 9:34
• Thanks, I'll take your word on this one since I don't understand either of those even after a quick google. I'll just stick to AES or web crypto like you suggested – reheem May 15 at 10:05
• WebCrypto is a recommendation from W3C by the way, Mozilla Developer Network has a nice description of this technology if you need reference. – DannyNiu May 15 at 10:35
• "Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can't break." --- Bruce Schneier – Swashbuckler May 15 at 19:37

No. It is not secure. This is very simple substitution algorithm. It shows patterns clearly. If the encrypted message is long enough or if you have many short encrypted messages, you can crack it using simple frequency analysis. You don't need any complex technique to crack it.

Example:

let data = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
let key = "12345";
console.log(data.encrypt(key));
console.log(data.encrypt(key));
console.log(data.encrypt(key));


Result:

dopqrsopqrsopqrsopqrsopqrso~1}11pqrsopqrsopqrsopqrsopqrsb
dopqrsopqrsopq}33rsopqrsopqrso~3pqrsopqrsopqrsopqrsopqrsq
Nqrsopqrs}38opqrsopqrsopqrsopqrsopqrsopqrsopqrsopqrs~0opv


You see patterns clearly.

• I've locked the question so others can see the library is broken (but the question itself is off topic and I don't want to have a discussion here with the author or other defenders of this "cypher"). After upvoting cause I'm sometimes nice like that :) – Maarten Bodewes Jun 1 at 22:16