Web Crypto API
Browser-built-in crypto API accessible via window.crypto.subtle. Promise-based. Supports AES, SHA, RSA, ECDSA, ECDH, HKDF, PBKDF2. Standard since ~2016, broadly implemented.
Better than JS libs (CryptoJS, sjcl): native implementations are constant-time + hardware-accelerated. Doesn't send keys outside the browser process (CryptoKey objects are opaque). Limitation: AES-GCM, RSA-OAEP, ECDSA is standardized — ChaCha20, Ed25519 have been slow to standardize (Ed25519 finally in Chrome 113, 2023). User-land alternative: WebAssembly port of libsodium for modern ciphers. Classic use: E2EE web apps (Standard Notes, ProtonMail), client-side encryption before upload.