# Is @noble/hashes ESM-only? Can you require() it?

> @noble/hashes@2.4.0 is ESM-only. ESM-only since 2.0.0 — last CommonJS version is 1.8.0.

Audited & minimal 0-dependency JS implementation of SHA, RIPEMD, BLAKE, HMAC, HKDF, PBKDF & Scrypt

Last verified Sep 9, 2026 against @noble/hashes@2.4.0.

@noble/hashes dropped its CommonJS build in 2.0.0 (August 2025). The last version with a plain require()-able CommonJS entry is 1.8.0, published Apr 21, 2025; it declares support for Node.js ^14.21.3 || >=16.

require("@noble/hashes") failed in our probe on Node.js 20+ as well; see the runtime table for the error before relying on it. Node.js 18 has no require(esm), and @noble/hashes@2.4.0 declares Node.js >= 20.19.0, so 18 is outside its supported range anyway.

@noble/hashes@2.4.0 declares engines ">= 20.19.0", so Node.js 18 is outside its supported range regardless of module format.

## What to do

1. require("@noble/hashes") failed in our probe on Node.js 20+ as well; see the runtime table for the error before relying on it.
2. From a CommonJS file, use a dynamic import inside an async function: const hashes = await import("@noble/hashes"). That works on every Node.js version the package supports (>= 20.19.0).
3. If you need a synchronous require() or run Node.js 18: npm install @noble/hashes@1.8.0, the last CommonJS release (published Apr 21, 2025); it declares Node.js ^14.21.3 || >=16.
4. @noble/hashes@2.4.0 declares engines ">= 20.19.0", so Node.js 18 is unsupported regardless: upgrade Node.js or pin an older release.
5. TypeScript: types are bundled; install nothing extra.

## Facts

- Latest: 2.4.0 (Aug 27, 2026)
- Module format: ESM-only
- Last CommonJS version: 1.8.0
- ESM-only since: 2.0.0 (Aug 25, 2025)
- TypeScript types: bundled
- Node engines: >= 20.19.0
- Weekly downloads: 63.5M
- License: MIT

## Runtime test results for @noble/hashes@2.4.0

Installed and executed on Sep 9, 2026 with require("@noble/hashes") from a CommonJS file and import "@noble/hashes" from an ES module.

| Runtime | require("@noble/hashes") | import "@noble/hashes" |
|---|---|---|
| Node.js 18 | fails (ERR_REQUIRE_ESM) | fails (Error) |
| Node.js 20 | fails (Error) | fails (Error) |
| Node.js 22 | fails (Error) | fails (Error) |
| Node.js 24 | fails (Error) | fails (Error) |
| Node.js 26 | fails (Error) | fails (Error) |
| Bun 1.4.0 | fails (Error) | fails (Error) |

## How to import @noble/hashes

ES modules:

```js
import * as hashes from "@noble/hashes";
```

Namespace import shown because the ESM entry may have no default export; use named imports for what it exports.

CommonJS:

```js
// require("@noble/hashes") failed in our probe on Node.js 20.19+, 22.12+ and newer as well (root module cannot be imported: import submodules instead. Check out README); see the runtime table.

// Any Node.js version the package supports (>= 20.19.0), from an async function:
async function main() {
  const hashes = await import("@noble/hashes");
}

// Or pin the last CommonJS release (declares Node.js ^14.21.3 || >=16):
// npm install @noble/hashes@1.8.0
```

## Module format by version

Derived from the type, main and exports fields of every stable release on npm (41 versions; the newest 41 shown).

| Versions | Format | First published |
|---|---|---|
| 2.0.0 – 2.4.0 | ESM-only | Aug 25, 2025 |
| 0.4.2 – 1.8.0 | Dual (CommonJS + ESM) | Dec 3, 2021 |
| 0.4.0 – 0.4.1 | CommonJS | Nov 7, 2021 |

## Frequently asked

**Is @noble/hashes ESM-only?**

@noble/hashes@2.4.0 is ESM-only. @noble/hashes dropped its CommonJS build in 2.0.0 (August 2025). The last version with a plain require()-able CommonJS entry is 1.8.0, published Apr 21, 2025; it declares support for Node.js ^14.21.3 || >=16.

**Which version of @noble/hashes still supports CommonJS / require()?**

1.8.0 is the last version of @noble/hashes with a CommonJS build; it declares Node.js ^14.21.3 || >=16. Install it with "npm install @noble/hashes@1.8.0". Every version from 2.0.0 on is ESM-only.

**How do I use @noble/hashes from a CommonJS file?**

From a CommonJS file, use a dynamic import inside an async function: const hashes = await import("@noble/hashes"). That works on every Node.js version the package supports (>= 20.19.0). require("@noble/hashes") failed in our probe on Node.js 20+ as well; see the runtime table for the error before relying on it. Alternatively pin @noble/hashes@1.8.0 (declares Node.js ^14.21.3 || >=16).

**Does @noble/hashes work in Bun?**

Importing @noble/hashes failed in Bun 1.4.0 on Sep 9, 2026: error: root module cannot be imported: import submodules instead. Check out README

**Does @noble/hashes ship TypeScript types?**

Yes. @noble/hashes bundles its own type declarations; no @types package is needed.

## Links

- [@noble/hashes on npm](https://www.npmjs.com/package/@noble/hashes)
- [Source repository](https://github.com/paulmillr/noble-hashes)
- [HTML version](https://canirequire.com/package/@noble/hashes/)
- [JSON version](https://canirequire.com/package/@noble/hashes.json)

---

For scripts and AI agents: any package is at https://canirequire.com/package/<name>/index.md (Markdown) or https://canirequire.com/package/<name>.json (JSON); the site index is https://canirequire.com/llms.txt. Fetch the URL directly; no search needed.