# Is cookie-signature ESM-only? Can you require() it?

> cookie-signature@1.2.2 is a CommonJS package. CommonJS — require() works on every Node.js version we test.

Sign and unsign cookies

Last verified Sep 9, 2026 against cookie-signature@1.2.2.

cookie-signature ships CommonJS only. require("cookie-signature") works on every Node.js version we test (18, 20, 22, 24 and 26) and in Bun. The package declares Node.js >=6.6.0. import "cookie-signature" also works because Node.js and Bun can import CommonJS from ES modules, but only the default export is guaranteed; named imports depend on Node's static analysis of the module.

## What to do

1. require("cookie-signature") works on every Node.js version we test (18, 20, 22, 24 and 26) and in Bun. The package declares Node.js >=6.6.0.
2. From ES modules use the default import: import cookieSignature from "cookie-signature"; then destructure. Named imports only work when Node.js can statically detect the exports.
3. TypeScript: npm install -D @types/cookie-signature

## Facts

- Latest: 1.2.2 (Oct 29, 2024)
- Module format: CommonJS
- Last CommonJS version: 1.2.2
- TypeScript types: @types/cookie-signature
- Node engines: >=6.6.0
- Weekly downloads: 122.7M
- License: MIT

## Runtime test results for cookie-signature@1.2.2

Installed and executed on Sep 9, 2026 with require("cookie-signature") from a CommonJS file and import "cookie-signature" from an ES module.

| Runtime | require("cookie-signature") | import "cookie-signature" |
|---|---|---|
| Node.js 18 | works | works |
| Node.js 20 | works | works |
| Node.js 22 | works | works |
| Node.js 24 | works | works |
| Node.js 26 | works | works |
| Bun 1.4.0 | works | works |

## How to import cookie-signature

ES modules:

```js
import cookieSignature from "cookie-signature";
```

CommonJS:

```js
const cookieSignature = require("cookie-signature");
```

## Module format by version

Derived from the type, main and exports fields of every stable release on npm (13 versions; the newest 13 shown).

| Versions | Format | First published |
|---|---|---|
| 0.0.1 – 1.2.2 | CommonJS | Oct 15, 2012 |

## Frequently asked

**Is cookie-signature ESM-only?**

cookie-signature@1.2.2 is a CommonJS package. cookie-signature ships CommonJS only. require("cookie-signature") works on every Node.js version we test (18, 20, 22, 24 and 26) and in Bun. The package declares Node.js >=6.6.0. import "cookie-signature" also works because Node.js and Bun can import CommonJS from ES modules, but only the default export is guaranteed; named imports depend on Node's static analysis of the module.

**Can I import cookie-signature with ES module syntax?**

Yes. import cookieSignature from "cookie-signature" works in Node.js and Bun because they support importing CommonJS modules. Named imports work only when Node.js can statically detect the exports.

**Does cookie-signature work in Bun?**

Yes. import "cookie-signature" loaded successfully in Bun 1.4.0 on Sep 9, 2026.

**Does cookie-signature ship TypeScript types?**

Not bundled. Install the community types with "npm install -D @types/cookie-signature".

## Links

- [cookie-signature on npm](https://www.npmjs.com/package/cookie-signature)
- [Source repository](https://github.com/visionmedia/node-cookie-signature)
- [HTML version](https://canirequire.com/package/cookie-signature/)
- [JSON version](https://canirequire.com/package/cookie-signature.json)

---

For scripts and AI agents: any package is at https://canirequire.com/package/<name>/index.md (Markdown) or https://canirequire.com/package/<name>.json (JSON); the site index is https://canirequire.com/llms.txt. Fetch the URL directly; no search needed.