Pre-release for the null safety migration of this package.

Note that 2.2.0 may not be the final stable null safety release version, we reserve the right to release it as a 3.0.0 breaking change.

This release will be pinned to only allow pre-release sdk versions starting from 2.10.0-2.0.dev, which is the first version where this package will appear in the null safety allow list.

  • Adds SHA-2 512/224 and SHA-2 512/256 from FIPS 180-4

  • Deprecates newInstance instance members on some classes and updates documentation.


  • Improve example and package description to address package site maintenance suggestions.


  • BugFix: padding was incorrect for some SHA-512/328.


  • Security vulnerability: Fixed constant-time comparison in Digest.


  • Fix bug in SHA-2 384/512 blocksize.
  • Added HMAC-SHA-2 test vectors


  • Bump version number for publish mishap (spare file uploaded with pub publish).


  • Added a workaround for a bug in DDC (used in build_web_compilers 1.x). This bug is not present in DDK (used in build_web_compilers 2.x).


  • Added SHA384, and SHA512
  • Add Sha224 + Refactor
  • Support 32bit and 64bit operations for SHA384/51
  • Add conditional imports
  • De-listify 32bit allocations
  • Add sha monte tests for 224,256,384, and 512


  • Changed the max message size instead to 0x3ffffffffffff, which is the largest portable value for both JS and the Dart VM.


  • Made max message size a BigNum instead of an int so that dart2js can compile with crypto.


  • Updated SDK version to 2.0.0-dev.17.0


  • Fix SDK constraint.


  • Prepare HashSink implementation for limiting integers to 64 bits in Dart language.


  • Support convert 2.0.0.


Note: There are no APIs in 2.0.0 that weren't also in 0.9.2. Packages that would use 2.0.0 as a lower bound should use 0.9.2 instead—for example, crypto: ">=0.9.2 <3.0.0".

  • Hash and Hmac no longer extend ChunkedConverter.


  • Properly close sinks passed to Hash.startChunkedConversion() when ByteConversionSink.close() is called.


  • Hmac and Hash now extend the new ChunkedConverter class from dart:convert.

  • Fix all strong mode warnings.


  • All APIs that were deprecated in 0.9.2 have been removed. No new APIs have been added. Packages that would use 1.0.0 as a lower bound should use 0.9.2 instead—for example, crypto: ">=0.9.2 <2.0.0".


  • Avoid core library methods that don't work on dart2js.


  • Hash, MD5, SHA1, and SHA256 now implement Converter. They convert between List<int>s and the new Digest class, which represents a hash digest. The Converter APIs—Hash.convert() and Hash.startChunkedConversion—should be used in preference to the old APIs, which are now deprecated.

  • SHA1, SHA256, and HMAC have been renamed to Sha1, Sha256, and Hmac, respectively. The old names still work, but are deprecated.

  • Top-level sha1, sha256, and md5 fields have been added to make it easier to use those hash algorithms without having to instantiate new instances.

  • Hashing now works correctly for input sizes up to 2^64 bytes.


  • Hash.add, Hash.close, and Hash.newInstance are deprecated. Hash.convert should be used for hashing single values, and Hash.startChunkedConversion should be used for hashing streamed values.

  • SHA1 and SHA256 are deprecated. Use the top-level sha1 and sha256 fields instead.

  • While the MD5 class is not deprecated, the new MD5() constructor is. Use the top-level md5 field instead.

  • HMAC is deprecated. Use Hmac instead.

  • Base64Codec, Base64Encoder, Base64Decoder, Base64EncoderSink, Base64DecoderSink, and BASE64 are deprecated. Use the Base64 APIs in dart:convert instead.

  • CryptoUtils is deprecated. Use the Base64 APIs in dart:convert and the hex APIs in the convert package instead.


  • Base64 convert returns an Uint8List
  • Base64 codec and encoder can now take an encodePaddingCharacter
  • Implement a Base64 codec similar to codecs in ‘dart:convert’


  • ChangeLog starts here.