I'm creating a server which can store cookies on the web that will contain application settings. The server will accept any data, but I want to encrypt all the settings before storing them in a cookie and decrypt them when reading them out. So I can store very sensitive data like Account Usernames & Passwords in the cookies and the server cannot do anything with it.

My question is now: What is the best way to encrypt such data with a password in JavaScript on the client side? What is the most secure?

I need some code that I can embed into my site and use it from there.

I'm creating a server which can store cookies on the web that will contain application settings. The server will accept any data, but I want to encrypt all the settings before storing them in a cookie and decrypt them when reading them out. So I can store very sensitive data like Account Usernames & Passwords in the cookies and the server cannot do anything with it.

My question is now: What is the best way to encrypt such data with a password in JavaScript on the client side? What is the most secure?

I need some code that I can embed into my site and use it from there.

• javascript
• encryption

• 3 SSL... – Kevin Peno Commented Apr 25, 2011 at 20:35

3 Answers 3

I'd recommend using AES encryption in your JavaScript code. See Javascript AES encryption for libraries and links. The trouble you'll have is picking a key that is only available on the client side. Perhaps you can prompt the user? Or hash together some client system information that's not sent to the server.

EDIT: Misunderstood your question. Check out this question instead:

What encryption algorithm is best for encrypting cookies?

You could try a Vernam Cypher with the password.

Basically you use the password as the key and then XOR the string to encrypt with the password. This can be reversed as well.

Here is a wikipedia page this type of encryption http://en.wikipedia.org/wiki/XOR_cipher

Example Code

function encrypt(key, value) {
  var result="";
  for(i=0;i<value.length;++i)
  {
    result+=String.fromCharCode(key[i % key.length]^value.charCodeAt(i));
  }
  return result;
}

function decrypt()
{
 var result="";
  for(i=0;i<value.length;++i)
  {
    result+=String.fromCharCode(key[i % key.length]^value.charCodeAt(i));
  }
  return result;
}

I haven't tested this but its probably close. you will notice the encrypt and decrypt functions should be identical