Security is the part of an app you can’t afford to get subtly wrong — and it’s exactly the part developers are most often forced to improvise. The Lacspace Security Kit turns the hard primitives into clean, one-line APIs, all built on vetted platform crypto.
Never hand-roll crypto
Almost every crypto vulnerability starts with someone re-implementing something that already exists correctly. Lacspace builds on the Web Crypto API — the same primitives your platform ships and audits — so encryption, hashing and signing are correct and constant-time by default.
Ten layers, one philosophy
- @lacspace/crypto — AES-GCM encrypt/decrypt.
- @lacspace/password — scrypt hashing with safe comparison.
- @lacspace/jwt — sign and verify tokens.
- @lacspace/apikey — issue and check API keys.
- @lacspace/otp — TOTP one-time codes.
- @lacspace/webauthn — passkeys / FIDO2.
- @lacspace/mfa — multi-factor flows.
- @lacspace/lock — brute-force lockout.
- @lacspace/headers — HSTS, CSP, frame guard.
- @lacspace/redact — scrub secrets from logs.
What it looks like
import { hash, verify } from '@lacspace/password';
const stored = await hash(password);
await verify(password, stored); // true / false — constant-timeThat’s the whole API surface you need for password login — no config, no crypto knobs, no dependencies.
Get it
Read the APIs at lacspace.com/docs, browse the kit at lacspace.com/packages, and see how it fits the wider Lacspace ecosystem.
Frequently asked questions
What is the Lacspace Security Kit?
A set of ten packages that give you real security primitives as clean, one-line APIs — crypto, password, jwt, apikey, otp, webauthn, mfa, lock, headers and redact — all built on the Web Crypto API and safe defaults, with zero third-party dependencies.
Does it hand-roll cryptography?
No — and that is the whole point. Every cryptographic operation is built on the vetted Web Crypto API (AES-GCM, scrypt-style hashing, HMAC), so you get correct, constant-time behaviour without re-implementing anything yourself.
What can I build with it?
Password login (hash/verify), JWT sessions, API keys, TOTP two-factor codes, passkeys/WebAuthn, full MFA flows, brute-force lockouts, security headers (HSTS/CSP/frame guard) and log redaction — the seven-plus layers every serious app needs.
Where does it run?
Anywhere — Node, edge runtimes and the browser — because it uses Web-standard crypto rather than Node-only modules.
Is it production-ready and free?
It is designed for production and used across Lacspace products. The free-tier packages are under the Lacspace Free Licence; check each package page for its tier and read the API at lacspace.com/docs.
