I think this is counterproductive - transpiling and relying on emscripten to be cryptographically secure in not changing your code is the very definition of rolling your own crypto. How do you know that you&#x27;re compiling the right things to js?<p>The post says they&#x27;ve taken a cursory look at emscripten to make sure it doesn&#x27;t have &quot;timing attacks&quot; in one short sentence. This is exactly the kind of verification that requires an experienced and professional cryptanalyst to audit, examine, and finally confirm that emscripten -&gt; js indeed doesn&#x27;t expose the cryptographic algorithms to side channel attacks, or add additional weaknesses to the cryptography.<p>If the authors of the original post are not cryptographically confident enough to &quot;roll their own crypto&quot; how can they verify that their tool chain is secure?<p>Don&#x27;t roll your own crypto, especially in using tools that haven&#x27;t been verified to be used in crypto by cryptanalysis.