crypto on Grafana Labs

getRandomValues

Mon, 21 Sep 2026 15:16:28 +0000

getRandomValues

The getRandomValues() method fills the passed TypedArray with cryptographically sound random values.

Usage

getRandomValues(typedArray)

Parameters

Name	Type	Description
`typedArray`	`TypedArray`	An integer-based `TypedArray` to fill with random values. Accepted `TypedArray` specific types are: `Int8Array`, `Uint8Array`, `Uint8ClampedArray`, `Int16Array`, `Uint16Array`, `Int32Array`, or `Uint32Array`.

Return Value

The same array is passed as the typedArray parameter with its contents replaced with the newly generated random numbers. The typedArray parameter is modified in place, and no copy is made.

Throws

Type	Description
`TypeError`	Thrown when `typedArray` is missing, `null`, or `undefined`, or its `length` has been overridden with a negative value.
`QuotaExceededError`	Thrown when `typedArray` is too large and its `byteLength` exceeds 65536.

Example

export default function () {
  const array = new Uint32Array(10);
  crypto.getRandomValues(array);

  for (const num of array) {
    console.log(num);
  }
}

CryptoKey

Mon, 21 Sep 2026 15:16:28 +0000

CryptoKey

The CryptoKey object represents a cryptographic key used for encryption, decryption, signing, or verification within the webcrypto module. The CryptoKey object is created using the SubtleCrypto.generateKey() or SubtleCrypto.importKey() methods.

Properties

Property	Type	Description
type	`string`	Indicates the type of the key material. Possible values are `public`, `private`, `secret`, `unspecified`, or `unknown`.
extractable	`boolean`	Indicates whether the raw key material can be exported.
algorithm	`object`	An object containing the algorithm used to generate or import the key.
usages	`string[]`	An array of strings indicating the cryptographic operations that the key can be used for. Possible values are `encrypt`, `decrypt`, `sign`, `verify`, `deriveKey`, `deriveBits`, `wrapKey`, and `unwrapKey`.

randomUUID

Mon, 21 Sep 2026 15:16:28 +0000

randomUUID

The randomUUID method produces a 36-characters long string that contains a cryptographically random UUID v4.

Usage

randomUUID()

Return Value

A string containing a 36-character cryptographically random UUID v4.

Example

export default function () {
  const myUUID = crypto.randomUUID();

  console.log(myUUID);
}

SubtleCrypto

Mon, 21 Sep 2026 15:16:28 +0000

SubtleCrypto

The SubtleCrypto interface provides a set of low-level cryptographic primitives such as encryption, decryption, digital signature generation and verification, and key generation and management. It is useful for using secure and efficient cryptographic operations within k6 scripts.

Methods

Method	Description
encrypt	Encrypts the given plaintext data using the specified algorithm and key.
decrypt	Decrypts the given ciphertext data using the specified algorithm and key.
sign	Signs the given data using the specified algorithm and key.
verify	Verifies the signature of the given data using the specified algorithm and key.
digest	Computes the digest (hash) of the given data using the specified algorithm.
generateKey	Generates a new cryptographic key for use with the specified algorithm.
importKey	Imports a raw key material into the Web Crypto API, generating a new key object to use with the specified algorithm.
exportKey	Exports the raw key material of the given key object.
deriveBits	Derives bits using provided input.
deriveKey	Derives a secret key from a master key.

Example

export default async function () {
  const plaintext = new TextEncoder().encode('Hello, World!');

  /**
   * Generate a symmetric key using the AES-CBC algorithm.
   */
  const key = await crypto.subtle.generateKey(
    {
      name: 'AES-CBC',
      length: 256,
    },
    true,
    ['encrypt', 'decrypt']
  );

  /**
   * Encrypt the plaintext using the AES-CBC key with
   * have generated.
   */
  const iv = crypto.getRandomValues(new Uint8Array(16));
  const ciphertext = await crypto.subtle.encrypt(
    {
      name: 'AES-CBC',
      iv: iv,
    },
    key,
    plaintext
  );

  /**
   * Decrypt the ciphertext using the same key to verify
   * that the resulting plaintext is the same as the original.
   */
  const deciphered = await crypto.subtle.decrypt(
    {
      name: 'AES-CBC',
      iv: iv,
    },
    key,
    ciphertext
  );

  console.log(
    'deciphered text == original plaintext: ',
    arrayBufferToHex(deciphered) === arrayBufferToHex(plaintext)
  );
}

function arrayBufferToHex(buffer) {
  return [...new Uint8Array(buffer)].map((x) => x.toString(16).padStart(2, '0')).join('');
}

AesCbcParams

Mon, 21 Sep 2026 15:16:28 +0000

AesCbcParams

The AesCbcParams object represents the object that should be passed as the algorithm parameter into the encrypt and decrypt operation when using the AES-CBC algorithm.

For more details, head to the MDN Web Crypto API documentation on AES-CBC.

Properties

Property	Type	Description
name	`string`	Should be set to `AES-CBC`.
iv	`ArrayBuffer`, `TypedArray`, or `DataView`	The initialization vector. Must be 16 bytes, unpredictable and cryptographically random. Yet, it doesn’t need to be secret and can be transmitted along with the ciphertext.

Example

export default async function () {
  const plaintext = new TextEncoder().encode('Hello, World!');

  /**
   * Generate a symmetric key using the AES-CBC algorithm.
   */
  const key = await crypto.subtle.generateKey(
    {
      name: 'AES-CBC',
      length: 256,
    },
    true,
    ['encrypt', 'decrypt']
  );

  /**
   * Encrypt the plaintext using the AES-CBC key with
   * have generated.
   */
  const ciphertext = await crypto.subtle.encrypt(
    {
      name: 'AES-CBC',
      iv: crypto.getRandomValues(new Uint8Array(16)),
    },
    key,
    plaintext
  );
}

AesCtrParams

Mon, 21 Sep 2026 15:16:28 +0000

AesCtrParams

The AesCtrParams object represents the object that should be passed as the algorithm parameter into the encrypt and decrypt operation when using the AES-CTR algorithm.

For more details, head to the MDN Web Crypto API documentation on AES-CTR.

Properties

Property	Type	Description
name	`string`	Should be set to `AES-CTR`.
counter	`ArrayBuffer`, `TypedArray`, or `DataView`	The initial value of the counter block. This must be 16-bytes long, like the AES block size.
length	`number`	The number of bits in the counter block that are used for the actual counter. It is recommended to use 64 (half of the counter block).

Example

export default async function () {
  const plaintext = new TextEncoder().encode('Hello, World!');

  /**
   * Generate a symmetric key using the AES-CTR algorithm.
   */
  const key = await crypto.subtle.generateKey(
    {
      name: 'AES-CTR',
      length: 256,
    },
    true,
    ['encrypt', 'decrypt']
  );

  /**
   * Encrypt the plaintext using the AES-CTR key with
   * have generated.
   */
  const ciphertext = await crypto.subtle.encrypt(
    {
      name: 'AES-CTR',
      counter: crypto.getRandomValues(new Uint8Array(16)),
      length: 128,
    },
    key,
    plaintext
  );
}

AesGcmParams

Mon, 21 Sep 2026 15:16:28 +0000

AesGcmParams

The AesGcmParams object represents the object that should be passed as the algorithm parameter into the encrypt and decrypt operation when using the AES-GCM algorithm.

For more details, head to the MDN Web Crypto API documentation on AES-GCM.

Properties

Property	Type	Description
name	`string`	Should be set to `AES-GCM`.
iv	`ArrayBuffer`, `TypedArray`, or `DataView`	The initialization vector. It must be 12 bytes long, unpredictable and cryptographically random. It must be unique for every encryption operation carried out with a given key. Never reuse an iv with the same key. Yet, it doesn’t need to be secret and can be transmitted along with the ciphertext.
additionalData (optional)	`ArrayBuffer`, `TypedArray` or `DataView`	Additional data that should be authenticated, but not encrypted. It must be included in the calculation of the authentication tag, but not encrypted itself.
tagLength (optional)	`number`	The length of the authentication tag in bits. Should be set, and will default to 96.

Example

export default async function () {
  const plaintext = new TextEncoder().encode('Hello, World!');

  /**
   * Generate a symmetric key using the AES-CBC algorithm.
   */
  const key = await crypto.subtle.generateKey(
    {
      name: 'AES-GCM',
      length: 256,
    },
    true,
    ['encrypt', 'decrypt']
  );

  /**
   * Encrypt the plaintext using the AES-CBC key with
   * have generated.
   */
  const ciphertext = await crypto.subtle.encrypt(
    {
      name: 'AES-GCM',
      iv: crypto.getRandomValues(new Uint8Array(12)),
    },
    key,
    plaintext
  );
}

RsaOaepParams

Mon, 21 Sep 2026 15:16:28 +0000

RsaOaepParams

The RsaOaepParams object represents the object that should be passed as the algorithm parameter into the encrypt and decrypt operation when using the RSA-OAEP algorithm.

For more details, head to the MDN Web Crypto API documentation on RSA-OAEP.

Properties

Property	Type	Description
name	`string`	Should be set to `RSA-OAEP`.
label (optional)	`ArrayBuffer`, `TypedArray`, or `DataView`	It’s an array of bytes that does not itself need to be encrypted but which should be bound to the ciphertext. A digest of the label is part of the input to the encryption operation. Unless your application calls for a label, you can just omit this argument, and it will not affect the security of the encryption operation.

AesKeyGenParams

Mon, 21 Sep 2026 15:16:28 +0000

AesKeyGenParams

The AesKeyGenParams object represents the object that should be passed as the algorithm parameter into the generateKey operation when generating an AES key.

Properties

Property	Type	Description
name	`string`	The name of the algorithm. Possible values are `AES-CBC`, `AES-CTR`, and `AES-GCM`.
length	`number`	The length of the key in bits. Possible values are 128, 192 or 256.

Example

export default async function () {
  const key = await crypto.subtle.generateKey(
    {
      name: 'AES-CBC',
      length: 256,
    },
    true,
    ['encrypt', 'decrypt']
  );
}

CryptoKeyPair

Mon, 21 Sep 2026 15:16:28 +0000

CryptoKeyPair

The CryptoKeyPair object represents an asymmetric key pair with public and private keys.

The generateKey method can be used to create CryptoKeyPair object for asymmetric algorithms such as ECDH or ECDSA.

Properties

Property	Type	Description
publicKey	`CryptoKey`	A public key.
privateKey	`CryptoKey`	A private key.

EcKeyGenParams

Mon, 21 Sep 2026 15:16:28 +0000

EcKeyGenParams

The EcKeyGenParams object represents the object that should be passed as the algorithm parameter into the generateKey operation when generating key pairs for ECDH or ECDSA algorithms.

Properties

Property	Type	Description
name	`string`	An algorithm name. Possible values are `ECDH` or `ECDSA`.
namedCurve	`string`	A elliptic curve’s name to use for key pair generation. Possible values are `P-256`, `P-384` or `P-521`.

Example

export default async function () {
  const keyPair = await crypto.subtle.generateKey(
    {
      name: 'ECDSA',
      namedCurve: 'P-256',
    },
    true,
    ['sign', 'verify']
  );

  console.log(JSON.stringify(keyPair));
}

EcdhKeyDeriveParams

Mon, 21 Sep 2026 15:16:28 +0000

EcdhKeyDeriveParams

The EcdhKeyDeriveParams represents the object that should be passed as the algorithm parameter into deriveBits, when using the ECDH algorithm.

ECDH is a secure communication method. Parties exchange public keys and use them with their private keys to generate a unique shared secret key.

Properties

Property	Type	Description
name	`string`	An algorithm name. Should be `ECDH`.
publicKey	`CryptoKey`	Another party’s public key.

EcdsaParams

Mon, 21 Sep 2026 15:16:28 +0000

EcdsaParams

The EcdsaParams represents the object that should be passed as the algorithm parameter into sign or verify when using the ECDSA algorithm.

Properties

Property	Type	Description
name	`string`	An algorithm name. Should be `ECDSA`.
hash	`string`	An identifier for the digest algorithm to use. Possible values are `SHA-256`, `SHA-384` or `SHA-512`.

Pbkdf2Params

Mon, 21 Sep 2026 15:16:28 +0000

Pbkdf2Params

The Pbkdf2Params object represents the parameters for the PBKDF2 algorithm. It should be passed as the algorithm parameter into deriveBits or deriveKey.

PBKDF2 (Password-Based Key Derivation Function 2) is designed to derive cryptographic keys from a password. It applies a pseudorandom function (such as HMAC) to the password along with a salt value and repeats the process many times to produce a derived key. The added computational work makes password cracking much more difficult.

Properties

Property	Type	Description
name	`string`	Should be set to `PBKDF2`.
hash	`string`	The hash function to use. Can be `SHA-1`, `SHA-256`, `SHA-384`, or `SHA-512`.
salt	`ArrayBuffer`	A random or pseudo-random value of at least 16 bytes.
iterations	`number`	The number of iterations to perform. Must be greater than 0. Should be as high as possible (e.g., 310000 for SHA-256).

Example

export default async function () {
  const password = new TextEncoder().encode('my secret password');

  // Import the password as a key
  const baseKey = await crypto.subtle.importKey('raw', password, 'PBKDF2', false, [
    'deriveBits',
    'deriveKey',
  ]);

  // Generate a random salt
  const salt = crypto.getRandomValues(new Uint8Array(16));

  // Derive bits using PBKDF2
  const derivedBits = await crypto.subtle.deriveBits(
    {
      name: 'PBKDF2',
      hash: 'SHA-256',
      salt: salt,
      iterations: 310000,
    },
    baseKey,
    256
  );

  console.log('derived bits: ' + arrayBufferToHex(derivedBits));
}

function arrayBufferToHex(buffer) {
  return [...new Uint8Array(buffer)].map((x) => x.toString(16).padStart(2, '0')).join('');
}

RsaPssParams

Mon, 21 Sep 2026 15:16:28 +0000

RsaPssParams

The RsaPssParams represents the object that should be passed as the algorithm parameter into sign or verify when using the RSA-PSS algorithm.

Properties

Property	Type	Description
name	`string`	An algorithm name. Should be `RSA-PSS`.
saltLength	`number`	A long integer representing the length of the random salt to use, in bytes.

Caution
Since under the hood we use Golang’s SDK the salt length 0 is not supported. In that case the maximum possible salt length will be used.

HmacKeyGenParams

Mon, 21 Sep 2026 15:16:28 +0000

HmacKeyGenParams

The HmacKeyGenParams object represents the object that should be passed as the algorithm parameter into the generateKey operation when generating an HMAC key.

Properties

Property	Type	Description
name	`string`	This should be set to `HMAC`.
hash	`string`	The name of the digest function to use. Possible values are `SHA-1`, `SHA-256`, `SHA-384` and `SHA-512`.
length (optional)	`number`	The length of the key in bits. If this is omitted, the length of the key is equal to the block size of the hash function you have chosen. We recommend to leave this parameter empty, unless you have a good reason to use something different.

Example

export default async function () {
  const key = await crypto.subtle.generateKey(
    {
      name: 'HMAC',
      hash: { name: 'SHA-512' },
      length: 256,
    },
    true,
    ['sign', 'verify']
  );
}

RsaHashedImportParams

Mon, 21 Sep 2026 15:16:28 +0000

RsaHashedImportParams

The RsaHashedImportParams represents the object that should be passed as the algorithm parameter into importKey when using the RSA algorithm.

Properties

Property	Type	Description
name	`string`	This should be set to `RSASSA-PKCS1-v1_5`, `RSA-PSS` or `RSA-OAEP`.
hash	`string`	`object`	The name or an object with a `name` property of the digest function to use. Possible values are `SHA-1`, `SHA-256`, `SHA-384` and `SHA-512`.

RSAHashedKeyGenParams

Mon, 21 Sep 2026 15:16:28 +0000

RSAHashedKeyGenParams

The RSAHashedKeyGenParams object represents the object that should be passed as the algorithm parameter into the generateKey operation when generating an RSA key pair.

Properties

Property	Type	Description
name	`string`	This should be set to `RSASSA-PKCS1-v1_5`, `RSA-PSS` or `RSA-OAEP`.
modulusLength	`number`	The length in bits of the RSA modulus. This should be at least 2048. Some organizations are now recommending that it should be 4096.
publicExponent	`Uint8Array`	The public exponent. Unless you have a good reason to use something else, specify `65537` here, which represented as a `Uint8Array` is `new Uint8Array([1, 0, 1])`
hash	`string`	`object`	The name or an object with a `name` property of the digest function to use. Possible values are `SHA-1`, `SHA-256`, `SHA-384` and `SHA-512`.

Example

export default async function () {
  const keyPair = await crypto.subtle.generateKey(
    {
      name: 'RSA-PSS',
      modulusLength: 2048,
      publicExponent: new Uint8Array([1, 0, 1]),
      hash: { name: 'SHA-256' },
    },
    true,
    ['sign', 'verify']
  );
}

JsonWebKey

Mon, 21 Sep 2026 15:16:28 +0000

JsonWebKey

The JsonWebKey object represents object/dictionary generated by exporting a CryptoKey or used as an input parameter for key import.

The properties of the JsonWebKey could vary depending on the algorithm and key type. See specification JsonWebKey for details.

Properties

Property	Type	Description
kty	`string`	The key type.
k	`string`	The key value.
alg	`string`	The algorithm.
ext	`bool`	The key is extractable.
key_ops	`string` array	The key operations.
crv	`string`	The curve name.
x	`string`	The x coordinate.
y	`string`	The y coordinate.
d	`string`	The private key.

Example

export default async function () {
  const jwk = {
    alg: 'HS256',
    ext: true,
    k: 'H6gLp3lw7w27NrPUn00WpcKU-IJojJdNzhL_8F6se2k',
    key_ops: ['sign', 'verify'],
    kty: 'oct',
  };

  const importedKey = await crypto.subtle.importKey(
    'jwk',
    jwk,
    { name: 'HMAC', hash: { name: 'SHA-256' } },
    true,
    ['sign', 'verify']
  );

  const exportedAgain = await crypto.subtle.exportKey('jwk', importedKey);

  console.log('exported again: ' + JSON.stringify(exportedAgain));
  // should print
  // INFO[0000] exported again: {"k":"H6gLp3lw7w27NrPUn00WpcKU-IJojJdNzhL_8F6se2k","kty":"oct","ext":true,"key_ops":["sign","verify"],"alg":"HS256"}  source=console
}