libsodium

libsodium is a modern, easy-to-use, portable, and cross-platform cryptographic library designed to make secure cryptography accessible to developers who are not cryptography experts. It is a fork of Daniel J. Bernstein's NaCl (Networking and Cryptography Library), created and maintained by Frank Denis (jedisct1) with the goal of providing a simpler, more consistent, and better-documented API while maintaining the same high level of security. The fundamental design philosophy of libsodium is: developers should not need to understand the intricate details of cryptographic algorithms to use them correctly — the library provides high-level functions with sensible defaults that are difficult to misuse, reducing the risk of implementation errors that could compromise security. Key features and algorithms include: authenticated encryption (secretbox using XSalsa20-Poly1305, secretstream using ChaCha20-Poly1305 for streaming), public-key authenticated encryption (box using Curve25519, XSalsa20, Poly1305), digital signatures (sign using Ed25519), hash functions (generic hashing using BLAKE2b, crypto_hash using SHA-512), password-based key derivation (Argon2id, scrypt), key exchange (X25519 Diffie-Hellman), random number generation (cryptographically secure, using the operating system CSPRNG), constant-time comparison functions to prevent timing attacks, secure memory management (locking memory pages to prevent swapping, zeroing memory after use), and HMAC. The library is available as a native C library with bindings for virtually every programming language including Python (PyNaCl), Ruby (RbNaCl), JavaScript (libsodium.js), Go, Rust, PHP, Java, and .NET. As of 2026, libsodium has over 12,000 GitHub stars and is used by Signal, WireGuard, and countless security-critical applications.