cordova-plugin-crypto-random

Native cryptographically secure random bytes.

Installation

Install from the TransferChain GitHub repository:

cordova plugin add https://github.com/TransferChain/cordova-plugin-crypto-random

Wait for Cordova's deviceready event before calling CryptoKit.Random. This package targets Android and iOS; it does not provide a browser fallback. The command targets the GitHub repository; repository publication is managed separately. This document does not imply an npm release is available.

iOS validation status

iOS testing is ongoing. Progress and validation updates will be shared regularly. XCTest sources are available, but macOS/Xcode execution has not yet been completed; verified iOS security behavior is not claimed.

Documentation

• Usage, parameters and examples
• Tests and verification
• Native implementation guide

Plugin entry point

After Cordova's deviceready event, access window.CryptoKit.Random. The methods below belong to that plugin object. See API examples for parameters, results and cleanup.

The shared CryptoKit JavaScript namespace contains only the plugins you install. Each package registers its own member without replacing its siblings. This namespace is separate from Apple's native CryptoKit framework.

API

randomBytes(length)

See the developer guide for argument details, native implementation, lifecycle, failure behavior and platform prerequisites. Length is a byte count. Returned bytes belong to the caller; wipe owned secret output after all operations using it have settled.

Tests and development

Plugin test sources live under tests/. See test setup for the suites included in this package and their harness requirements. Native checks require the Android or Xcode toolchain. A host mock passing is not evidence that Android or iOS device execution succeeded.

Contributing

Read the contribution guidelines for development setup, coding conventions, regression tests and pull request expectations.

Security

Recorded security-related regression results:

• Android emulator, 2026-10-06: binary random output and input-length bounds passed.
• Host bridge, 2026-10-08: numeric length forwarding and Uint8Array results passed. These checks do not certify statistical entropy; generation uses the native OS CSPRNG.

These are results from the dated validation runs, not a new execution for this documentation update. Android results are emulator results; they do not establish physical-device or iOS validation. Host mocks do not prove native execution. Passing regressions are not a security audit or certification. See test setup and scope.

Read SECURITY.md to report a vulnerability. Never include production credentials or secret values in reports or logs.

License

MIT, TransferChain AG. Dependencies and vendored components retain their respective licenses and attribution requirements.