This page has detailed information on how to build NSS. Because NSS is a cross-platform library that builds on many different platforms and has many options, it may be complex to build. Please read these instructions carefully before attempting to build.

Build environment

NSS needs a C and C++ compiler.  It has minimal dependencies, including only standard C and C++ libraries, plus zlib.

For building, you also need make.  Ideally, also install gyp and ninja and put them on your path.  This is recommended, as the build is faster and more reliable.


NSS compilation on Windows uses the same shared build system as Mozilla Firefox. You must first install the Windows Prerequisites, including MozillaBuild.

You can also build NSS on the Windows Subsystem for Linux, but the resulting binaries aren't usable by other Windows applications.

Get the source

NSS and NSPR use Mercurial for source control like other Mozilla projects. To check out the latest sources for NSS and NSPR--which may not be part of a stable release--use the following commands:

hg clone
hg clone

To get the source of a specific release, see NSS Releases.


Build NSS using our build script:


This builds both NSPR and NSS.

Build with make

Alternatively, there is a make target called "nss_build_all", which produces a similar result.  This supports some alternative options, but can be a lot slower.

make -C nss nss_build_all USE_64=1

The make-based build system for NSS uses a variety of variables to control the build. Below are some of the variables, along with possible values they may be set to.

Build a debug (non-optimized) version of NSS. This is the default.
Build an optimized (non-debug) version of NSS.
Build for a 32-bit environment/ABI. This is the default.
Build for a 64-bit environment/ABI. This is recommended.
Do not create an AddressSanitizer build. This is the default.
Create an AddressSanitizer build.

Unit testing

NSS contains extensive unit tests.  Scripts to run these are found in the tests directory.  Run the standard suite by:

HOST=localhost DOMSUF=localdomain nss/tests/

Replace localhost and localdomain with the hostname and domain suffix for your host (the tests just turn these into "$HOST.$DOMSUF"). If you don't have a domain suffix and you are on Windows, add this line to c:\Windows\System32\drivers\etc\hosts : localhost.localdomain . Validate by opening a command shell and typing: ping localhost.localdomain

Test output is stored in tests_results/security/$HOST.$NUMBER/.  The file results.html summarizes the results, output.log captures all the test output.

Other subdirectories of nss/tests contain scripts that run a subset of the full suite.

Document Tags and Contributors

Last updated by: m_t,