Show HN: Pw-punch – sub-2KB JWT/password crypto – Edge-native, 0 deps

1 point

a year ago

I needed a lightweight crypto lib for JWTs and password hashing that works without Node. So I built `pw-punch`, a 4KB WebCrypto-only toolkit — no deps, no config.

It works great on Cloudflare / Deno / Bun. Would love to hear what you think.

I've been working on a tiny crypto utility that requires *no dependencies*, *no Node.js*, and works purely on the WebCrypto API — ideal for edge runtimes like *Cloudflare Workers*, *Deno*, *Vercel*, or *Bun*.

Features: - Password hashing using PBKDF2 + random salt - JWT-style token signing (HMAC-SHA256 / SHA512) - Token verification with claim checks (exp, iat, nbf, iss, sub, aud) - `kid` support (key rotation) - ~4KB gzipped, 0 config, 0 install

I built it because I needed something that just works on the edge with *zero install bloat*. Would love to hear your thoughts or feedback.

1 comment