You can see the bug in this example: https://tonicdev.com/boucher/573e107d8596081100e6a4d9 The hash returned from sha.js should be the same as the one from the built in crypto package, but isn't.