# PKI.js: WebCrypto PKI Formats for TypeScript

> PKI.js implements common PKI structures in TypeScript while delegating cryptographic operations to WebCrypto. It suits applications handling X.509, CMS, OCSP, CRL, timestamping, S/MIME, and PKCS#12 without native plug-ins.

**PeculiarVentures/PKI.js** — PKI.js is a pure JavaScript library implementing the formats that are used in PKI applications (signing, encryption, certificate requests, OCSP and TSP requests/responses). It is built on WebCrypto (Web Cryptography API) and requires no plug-ins.

- Repository: https://github.com/PeculiarVentures/PKI.js
- Website: http://pkijs.org
- Stars: 1,404 · Forks: 217
- Language: TypeScript
- License: NOASSERTION
- Published: 2026-10-16 · Updated: 2026-10-16 · Language: en
- Canonical page: https://hysenlabs.com/projects/peculiarventures-pki-js

## PKI.js and the Browser PKI Gap

PKI.js addresses the gap between browser JavaScript and the structured formats used by Public Key Infrastructure applications. Certificate-enabled software often needs to create or validate X.509 certificates, generate PKCS#10 certificate requests, construct Cryptographic Message Syntax objects, process revocation information, or exchange timestamp data. These formats require more than attaching a signature to a byte array. They have defined structures, fields, identifiers, and relationships that applications must represent correctly.

The intended audience is TypeScript developers building certificate-enabled web applications or server-side JavaScript processes. The README states that PKI.js works uniformly in browsers, Node.js, and Deno. That shared model is useful for code that handles PKI data across client and server environments. It does not mean every WebCrypto implementation supports every algorithm, certificate parameter, or protocol variant required by a particular application.

Based on the repository layout, PKI.js is a format and protocol library rather than a certificate authority, UI toolkit, or general-purpose key management service. Applications remain responsible for deciding how private keys are generated, stored, protected, and transported. PKI.js supplies the data structures and related logic, while the host environment supplies cryptographic execution through WebCrypto.

## ASN.1 Models and WebCrypto Boundaries

PKI.js separates PKI data representation from direct cryptographic implementation. Its README says the library contains no cryptographic implementations and instead uses the Web Cryptography API. The package dependencies support this structure: `asn1js` handles ASN.1 operations, while `bytestreamjs`, `pvtsutils`, and `pvutils` provide byte and utility support. `@noble/hashes` is also listed as a runtime dependency.

An application can represent a certificate, enrollment request, signed CMS object, encrypted CMS object, CRL, OCSP message, or timestamp message as TypeScript structures. PKI.js provides logic associated with those formats. WebCrypto performs the supported cryptographic operations. The README connects X.509 certificates with RFC 5280, PKCS#10 enrollment with RFC 2986, CMS with RFC 5652, and timestamp handling with RFC 3161.

This separation avoids a bundled cryptographic engine, but it creates a compatibility boundary. The target runtime must expose WebCrypto, and that implementation must support the operation needed by the application. PKI.js cannot make an unsupported algorithm available through WebCrypto. Teams adopting the library should therefore inspect the specific certificate algorithms, signature algorithms, key types, and workflow they need rather than treating browser support as a single yes-or-no condition.

## Installing PKI.js and Starting a Real PKI Workflow

The README documents installation through npm. This command installs the stable package and records it in the project's npm dependencies:

```bash
npm install --save pkijs
```

There is no universal PKI.js command for issuing a certificate, signing a file, or starting a certificate authority. Instead, the README links examples for concrete workflows. The `examples/` directory includes directories for certificate creation and validation, PKCS#10 requests, CRLs, OCSP requests and responses, CMS signing, certificate-based and password-based encryption, timestamp requests and responses, PDF signature verification, S/MIME, and PKCS#12 files.

For a first use, select the workflow that matches the required data format. A certificate-enrollment application should begin with `examples/PKCS10ComplexExample/`. An application consuming revocation information should examine the CRL or OCSP directories. A CMS consumer should identify whether it needs signing, key-based encryption, or password-based encryption. A document or mail system should examine `examples/PDFExample/` or the S/MIME directories.

The README does not include a complete application example in its main text, and the repository documentation does not prescribe one universal setup sequence beyond installing `pkijs`. The relevant example files and the guides at `pkijs.org/docs` are the documented starting points for implementation details.

## Certificates, Enrollment, and Revocation Are Separate PKI Jobs

PKI.js covers several related formats, but those formats are not interchangeable. X.509 certificate creation and validation concern certificate identity, public keys, signatures, and validity information. PKCS#10 represents enrollment data and lets a requestor prove control of a public key. CRL creation and OCSP request and response handling support revocation, but CRL and OCSP are different mechanisms and should not be treated as equivalent labels.

The distinction affects adoption. A workflow that needs to prove key ownership does not necessarily need CMS signing. A file that contains CMS-encrypted content is not covered by the CMS signing example, even though both use the CMS family of structures. The repository separately documents CMS certificate-based encryption, CMS password-based encryption, CMS signing, and PKCS#7 certificate bags. Selecting the wrong example can produce a format mismatch even when the underlying application also uses certificates.

Timestamp processing follows another path. The README links the Time-Stamp Protocol in RFC 3161 to timestamping requests and responses, describing it as a way to prove that data existed before a particular time. PKI.js implements request and response structures, but the README does not document an included timestamp authority or a complete production service configuration. A deployment still needs an external authority or service with which its application can exchange the appropriate messages.

## What WebCrypto Dependency Means for Deployment

The absence of native plug-ins is a defining constraint. PKI.js delegates cryptographic work to WebCrypto, so the library follows what the host runtime provides. The README names browsers, Node.js, and Deno as target environments. It does not claim that all of those environments expose identical algorithms or capabilities.

This design differs from a PKI toolkit that ships its own cryptographic backend. A self-contained toolkit may control more of the cryptographic implementation, while PKI.js concentrates on PKI formats and uses the platform for supported cryptographic operations. The platform-based approach can fit applications seeking one JavaScript model across web and server environments. It can be unsuitable when a required algorithm or key type is unavailable through WebCrypto, or when deployment policy requires an internal cryptographic engine.

PKI.js is also not documented as a complete trust service. It does not replace certificate issuance, private-key storage, trust-store policy, or decisions about revocation and timestamp infrastructure. The application must establish trust appropriately and protect private keys. The library handles specified data formats and related operations, not the organizational controls around a production PKI deployment.

## Releases, Licensing, and Upgrade Responsibilities

The repository is not archived. Its last push was on 2026-09-30. Recent releases include v3.4.1 on 2026-09-20, v3.4.0 on 2026-03-18, and v3.3.3 on 2025-11-03. These dates show recent development and release activity, but they do not establish that an existing application can upgrade without changes.

GitHub classifies the repository license as a custom license that it cannot place into a standard category. The `LICENSE` file is therefore the source to inspect for exact permissions, conditions, and restrictions. The package metadata does not reproduce those terms. This review does not interpret the license or provide legal advice.

The source is primarily TypeScript, and `rollup.config.mjs` is present for builds. The scripts in `package.json` include `build`, `test`, `lint`, `format`, `coverage`, `build:examples`, and `prepublishOnly`. Development dependencies include TypeScript, Vitest, Oxc tooling, and Rollup plugins. The breadth of examples may help teams locate a comparable workflow, but it also means compatibility should be checked against the selected `pkijs` version and the WebCrypto environment used in deployment.

## Conclusion

PKI.js fits TypeScript teams that need to create, parse, sign, encrypt, or validate PKI structures and can use WebCrypto as their cryptographic backend. It is a poor fit when the custom LICENSE terms are unacceptable, native plug-ins are mandatory, or a required WebCrypto operation is unavailable. Before adoption, review `LICENSE`, select the closest example under `examples/`, and confirm that the intended browser or runtime supports the required algorithms and certificate parameters.

## FAQ

### What is PKI.js used for?

PKI.js implements common PKI formats in TypeScript and JavaScript, including X.509 certificates, PKCS#10 requests, CMS signing and encryption, CRLs, OCSP messages, and timestamp requests and responses.

### Does PKI.js include its own cryptographic implementation?

No. The README states that PKI.js contains no cryptographic implementations and instead uses the Web Crypto API.

### Can PKI.js run in Node.js and Deno?

Yes. The README lists browsers, Node.js, and Deno as supported environments, with WebCrypto supplying supported cryptographic operations.

### How do I install PKI.js?

The README documents installing the stable package with `npm install --save pkijs`.

## Sources

- [Issues](https://github.com/PeculiarVentures/PKI.js/issues)
- [PeculiarVentures/PKI.js on GitHub](https://github.com/PeculiarVentures/PKI.js)
- [Project website](http://pkijs.org)
- [README](https://github.com/PeculiarVentures/PKI.js/blob/master/README.md)
- [Releases](https://github.com/PeculiarVentures/PKI.js/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/peculiarventures-pki-js