Download websites that use crypto-js

About crypto-js

The geography of this library is the first thing worth explaining, because it is the part most likely to be misread. As of September 2026 we record crypto-js on 387,856 sites, and 279,130 of those resolve to France. A cryptography helper has no national character of its own, so a concentration of that size almost never reflects developer taste in one market. Concentration on that scale usually means the code arrives bundled inside something else: a hosting control panel, a shared theme, a payment widget or a builder template distributed by a provider with a heavy regional footprint. Anyone reading the country column as a proxy for demand should read it as a proxy for distribution instead.

crypto-js is a JavaScript libraries first released in 2009, written in JavaScript and published under the MIT license. The library dates from a period before browsers offered a usable native cryptography interface, which is why so much code still calls it for hashing, symmetric encryption and encoding work that the platform now handles on its own. Finding the library on a page therefore says more about the age of the code around it than about the security posture of the site. Client side cryptography is also frequently misapplied, and a researcher looking for pages that encrypt in the browser and then trust the result somewhere else has a legitimate reason to want the whole population rather than a handful of examples.

Version data is unusually rich here. We hold 35 distinct version strings, and the release we record most often is 4.1.1. Version spread matters for this library in particular, because older releases carry documented weaknesses in how they generate randomness, and a site pinned to an old bundle is normally pinned because nobody owns that dependency any more. Filtering by version turns a large list into a much smaller one that is actually actionable, whether the goal is a security notification, a vendor pitch or a research sample.

A per domain lookup answers whether one site loads the library. Our export answers the inverse question: given the library, which sites, in which country, on which suffix, at which version. Producing that from a lookup tool is not possible, because a lookup starts from the domain and we start from the technology. Each row carries the domain, the detection date, the country, the top level domain and the version string where one was exposed, which is what makes filtering, sampling and comparison over time possible at all.

Detection is inferential and undercounts. We identify crypto-js from the script it serves and from the fingerprints of bundles that embed it, so sites that compile the code into an application bundle under a different name fall out of the count. The concentration on .com likewise inherits the ordinary shape of the registration market rather than anything specific to this library. The site count should be read as a floor, not a census.