First Public Working Draft: Cryptography usage in Web Standards

Cryptography usage in Web Standards

https://www.w3.org/TR/2026/DNOTE-security-guidelines-cryptography-20260129/

Published by
 Security Interest Group

Abstract

This document serves as a clear, practical, and standards-compliant guide for recognized cryptographic algorithms and their appropriate applications in various scenarios. It provides recommendations on the selection and implementation of specific algorithms, parameter configurations, and common mistakes to avoid, aiming to foster a uniform, standards-driven, and secure application of cryptography in web technologies. 

The intended audience includes developers of web specifications and application creators, with the objective of encouraging interoperable, maintainable, and verifiable cryptographic practices in web standards and implementations.

Status of the Document

This section describes the status of this document at the time of its publication. A list of current W3C publications and the latest revision of this technical report can be found in the W3C standards and drafts index. 

This Group Note Draft is endorsed by the Security Interest Group, but is not endorsed by W3C itself nor its Members. 

To provide feedback regarding this specification, the preferred method is using GitHub. It is free to create a GitHub account to file issues. A list of issues filed as well as archives of previous mailing list public-security@w3.org (archive) discussions are publicly available. 

This document was published by the Security Interest Group as a Group Note Draft using the Note track. 

Group Draft Notes are not endorsed by W3C nor its Members. 

This is a draft document and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to cite this document as other than a work in progress. 

The W3C Patent Policy does not carry any licensing requirements or commitments on this document. 

This document is governed by the 18 August 2025 W3C Process Document.

-- 
This report was automatically generated using https://github.com/w3c/transition-notifier

Received on Thursday, 29 January 2026 06:31:40 UTC