diff --git a/lib/bcoin/hd.js b/lib/bcoin/hd.js
index 6e67693f..fcc9f585 100644
--- a/lib/bcoin/hd.js
+++ b/lib/bcoin/hd.js
@@ -58,7 +58,6 @@ var utils = bcoin.utils;
 var assert = utils.assert;
 
 var EventEmitter = require('events').EventEmitter;
-var crypto = require('crypto');
 
 var english = require('../../etc/english.json');
 
@@ -91,8 +90,7 @@ HDSeed.prototype.createSeed = function(passphrase) {
 };
 
 HDSeed._entropy = function(size) {
-  // XXX Do not use crypto
-  return Array.prototype.slice.call(crypto.randomBytes(size));
+  return randomBytes(size);
 };
 
 HDSeed._mnemonic = function(entropy) {
@@ -361,7 +359,7 @@ HDPriv._getIndexes = function(path) {
     if (!step || step[0] === '-') {
       return null;
     }
-    var index = +step; // cast to number
+    var index = +step;
     if (hard) {
       index += HARDENED;
     }
@@ -563,11 +561,30 @@ HDPub.prototype.deriveString = function(path) {
  * Helpers
  */
 
+var isBrowser = (typeof process !== 'undefined' && process.browser)
+  || typeof window !== 'undefined';
+
 function sha512hmac(data, salt) {
-  // XXX Do not use crypto
+  if (isBrowser) {
+    var hmac = hash.hmac(hash.sha512, utils.toArray(salt));
+    return hmac.update(utils.toArray(data)).digest();
+  }
+  var crypto = require('crypto');
   var hmac = crypto.createHmac('sha512', new Buffer(salt));
-  var hash = hmac.update(new Buffer(data)).digest();
-  return Array.prototype.slice.call(hash);
+  var h = hmac.update(new Buffer(data)).digest();
+  return Array.prototype.slice.call(h);
+}
+
+function randomBytes(size) {
+  if (isBrowser) {
+    var a = Uint8Array(size);
+    (window.crypto || window.msCrypto).getRandomValues(a);
+    var buf = new Array(size);
+    utils.copy(a, buf, 0);
+    return buf;
+  }
+  var crypto = require('crypto');
+  return Array.prototype.slice.call(crypto.randomBytes(size));
 }
 
 /**
diff --git a/lib/bcoin/wallet.js b/lib/bcoin/wallet.js
index 8d623e22..271a3edb 100644
--- a/lib/bcoin/wallet.js
+++ b/lib/bcoin/wallet.js
@@ -448,10 +448,7 @@ Wallet.prototype.fill = function fill(tx, cb) {
   return tx;
 };
 
-/**
- * P2SH+Multisig Redemption
- */
-
+// P2SH Multisig redeem script
 Wallet.prototype.getRedemption = function() {
   var sharedKeys = this.sharedKeys.slice().map(utils.toKeyArray);
   if (sharedKeys.length < this.m) {
diff --git a/package.json b/package.json
index 9037ca85..bfa23f89 100644
--- a/package.json
+++ b/package.json
@@ -24,7 +24,7 @@
     "async": "^0.8.0",
     "bn.js": "^0.10.0",
     "elliptic": "^3.0.3",
-    "hash.js": "^0.2.0",
+    "hash.js": "^1.0.3",
     "inherits": "^2.0.1"
   },
   "devDependencies": {