diff --git a/.github/workflows/check-code.yml b/.github/workflows/check-code.yml
index 8abe3e2..a30449b 100644
--- a/.github/workflows/check-code.yml
+++ b/.github/workflows/check-code.yml
@@ -1,6 +1,6 @@
 name: Check code
 
-on: push
+on: ["push", "pull_request"]
 
 jobs:
   build:
@@ -32,6 +32,7 @@ jobs:
         run: deno coverage --lcov coverage/ > coverage/lcov.info
 
       - name: Upload coverage to Coveralls.io
+
         uses: coverallsapp/github-action@v2.3.4
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }} # Generated by GitHub.
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 903986f..530ca01 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -48,5 +48,16 @@ jobs:
           config-file: deno.json # or deno.json
           tag: ${{ steps.gettag.outputs.tag }}
 
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          registry-url: "https://registry.npmjs.org"
+      - name: Transpile for npm
+        run: deno run --allow-all build.ts
+      - name: npm publish
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: cd npm && npm publish --provenance --access public
+
       - name: Publish to JSR
         run: deno publish --allow-dirty
diff --git a/.gitignore b/.gitignore
index 9b8a606..9a64271 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 .direnv
-coverage
\ No newline at end of file
+coverage
+npm/
\ No newline at end of file
diff --git a/build.ts b/build.ts
new file mode 100644
index 0000000..9706fbb
--- /dev/null
+++ b/build.ts
@@ -0,0 +1,30 @@
+// ex. scripts/build_npm.ts
+import { build, emptyDir } from "@deno/dnt";
+import denoJson from "./deno.json" with { type: "json" };
+
+await emptyDir("./npm");
+
+await build({
+  entryPoints: ["./mod.ts"],
+  outDir: "./npm",
+  shims: {
+    // see JS docs for overview and more options
+    deno: "dev",
+  },
+  testPattern: "tests/[!_]*_test.ts",
+  importMap: "deno.json",
+  typeCheck: false,
+  package: {
+    name: denoJson.name,
+    version: denoJson.version,
+    description: denoJson.description,
+    license: "MIT",
+    repository: {
+      type: "git",
+      url: "git+https://github.com/ankarhem/secrecy-ts.git",
+    },
+    bugs: {
+      url: "https://github.com/ankarhem/secrecy-ts/issues",
+    },
+  },
+});
diff --git a/deno.json b/deno.json
index 251a419..7d163f3 100644
--- a/deno.json
+++ b/deno.json
@@ -8,13 +8,16 @@
   },
   "license": "MIT",
   "imports": {
-    "@std/assert": "jsr:@std/assert@1",
-    "@std/testing": "jsr:@std/testing@^1.0.4",
-    "test-console": "npm:test-console@^2.0.0"
+    "@deno/dnt": "jsr:@deno/dnt@^0.41.3",
+    "@std/assert": "jsr:@std/assert@^1.0.7",
+    "@std/testing": "jsr:@std/testing@^1.0.4"
   },
   "compilerOptions": {
     "checkJs": true
   },
+  "test": {
+    "include": ["tests/**/*_test.ts"]
+  },
   "fmt": {
     "indentWidth": 2,
     "lineWidth": 80,
diff --git a/deno.lock b/deno.lock
index 7638715..d5db05b 100644
--- a/deno.lock
+++ b/deno.lock
@@ -1,27 +1,91 @@
 {
   "version": "4",
   "specifiers": {
+    "jsr:@david/code-block-writer@^13.0.2": "13.0.3",
+    "jsr:@deno/cache-dir@~0.10.3": "0.10.3",
+    "jsr:@deno/dnt@~0.41.3": "0.41.3",
+    "jsr:@std/assert@0.223": "0.223.0",
+    "jsr:@std/assert@0.226": "0.226.0",
     "jsr:@std/assert@1": "1.0.7",
     "jsr:@std/assert@^1.0.7": "1.0.7",
+    "jsr:@std/bytes@0.223": "0.223.0",
     "jsr:@std/data-structures@^1.0.4": "1.0.4",
+    "jsr:@std/fmt@0.223": "0.223.0",
+    "jsr:@std/fmt@1": "1.0.3",
+    "jsr:@std/fs@0.223": "0.223.0",
+    "jsr:@std/fs@1": "1.0.5",
     "jsr:@std/fs@^1.0.5": "1.0.5",
+    "jsr:@std/fs@~0.229.3": "0.229.3",
     "jsr:@std/internal@^1.0.5": "1.0.5",
+    "jsr:@std/io@0.223": "0.223.0",
+    "jsr:@std/path@0.223": "0.223.0",
+    "jsr:@std/path@1": "1.0.8",
+    "jsr:@std/path@1.0.0-rc.1": "1.0.0-rc.1",
     "jsr:@std/path@^1.0.7": "1.0.8",
     "jsr:@std/path@^1.0.8": "1.0.8",
+    "jsr:@std/path@~0.225.2": "0.225.2",
     "jsr:@std/testing@^1.0.4": "1.0.4",
-    "npm:@types/node@*": "22.5.4",
-    "npm:test-console@2": "2.0.0"
+    "jsr:@ts-morph/bootstrap@0.24": "0.24.0",
+    "jsr:@ts-morph/common@0.24": "0.24.0",
+    "npm:@types/node@*": "22.5.4"
   },
   "jsr": {
+    "@david/code-block-writer@13.0.3": {
+      "integrity": "f98c77d320f5957899a61bfb7a9bead7c6d83ad1515daee92dbacc861e13bb7f"
+    },
+    "@deno/cache-dir@0.10.3": {
+      "integrity": "eb022f84ecc49c91d9d98131c6e6b118ff63a29e343624d058646b9d50404776",
+      "dependencies": [
+        "jsr:@std/fmt@0.223",
+        "jsr:@std/fs@0.223",
+        "jsr:@std/io",
+        "jsr:@std/path@0.223"
+      ]
+    },
+    "@deno/dnt@0.41.3": {
+      "integrity": "b2ef2c8a5111eef86cb5bfcae103d6a2938e8e649e2461634a7befb7fc59d6d2",
+      "dependencies": [
+        "jsr:@david/code-block-writer",
+        "jsr:@deno/cache-dir",
+        "jsr:@std/fmt@1",
+        "jsr:@std/fs@1",
+        "jsr:@std/path@1",
+        "jsr:@ts-morph/bootstrap"
+      ]
+    },
+    "@std/assert@0.223.0": {
+      "integrity": "eb8d6d879d76e1cc431205bd346ed4d88dc051c6366365b1af47034b0670be24"
+    },
+    "@std/assert@0.226.0": {
+      "integrity": "0dfb5f7c7723c18cec118e080fec76ce15b4c31154b15ad2bd74822603ef75b3"
+    },
     "@std/assert@1.0.7": {
       "integrity": "64ce9fac879e0b9f3042a89b3c3f8ccfc9c984391af19e2087513a79d73e28c3",
       "dependencies": [
         "jsr:@std/internal"
       ]
     },
+    "@std/bytes@0.223.0": {
+      "integrity": "84b75052cd8680942c397c2631318772b295019098f40aac5c36cead4cba51a8"
+    },
     "@std/data-structures@1.0.4": {
       "integrity": "fa0e20c11eb9ba673417450915c750a0001405a784e2a4e0c3725031681684a0"
     },
+    "@std/fmt@0.223.0": {
+      "integrity": "6deb37794127dfc7d7bded2586b9fc6f5d50e62a8134846608baf71ffc1a5208"
+    },
+    "@std/fmt@1.0.3": {
+      "integrity": "97765c16aa32245ff4e2204ecf7d8562496a3cb8592340a80e7e554e0bb9149f"
+    },
+    "@std/fs@0.223.0": {
+      "integrity": "3b4b0550b2c524cbaaa5a9170c90e96cbb7354e837ad1bdaf15fc9df1ae9c31c"
+    },
+    "@std/fs@0.229.3": {
+      "integrity": "783bca21f24da92e04c3893c9e79653227ab016c48e96b3078377ebd5222e6eb",
+      "dependencies": [
+        "jsr:@std/path@1.0.0-rc.1"
+      ]
+    },
     "@std/fs@1.0.5": {
       "integrity": "41806ad6823d0b5f275f9849a2640d87e4ef67c51ee1b8fb02426f55e02fd44e",
       "dependencies": [
@@ -31,6 +95,28 @@
     "@std/internal@1.0.5": {
       "integrity": "54a546004f769c1ac9e025abd15a76b6671ddc9687e2313b67376125650dc7ba"
     },
+    "@std/io@0.223.0": {
+      "integrity": "2d8c3c2ab3a515619b90da2c6ff5ea7b75a94383259ef4d02116b228393f84f1",
+      "dependencies": [
+        "jsr:@std/assert@0.223",
+        "jsr:@std/bytes"
+      ]
+    },
+    "@std/path@0.223.0": {
+      "integrity": "593963402d7e6597f5a6e620931661053572c982fc014000459edc1f93cc3989",
+      "dependencies": [
+        "jsr:@std/assert@0.223"
+      ]
+    },
+    "@std/path@0.225.2": {
+      "integrity": "0f2db41d36b50ef048dcb0399aac720a5348638dd3cb5bf80685bf2a745aa506",
+      "dependencies": [
+        "jsr:@std/assert@0.226"
+      ]
+    },
+    "@std/path@1.0.0-rc.1": {
+      "integrity": "b8c00ae2f19106a6bb7cbf1ab9be52aa70de1605daeb2dbdc4f87a7cbaf10ff6"
+    },
     "@std/path@1.0.8": {
       "integrity": "548fa456bb6a04d3c1a1e7477986b6cffbce95102d0bb447c67c4ee70e0364be"
     },
@@ -39,10 +125,23 @@
       "dependencies": [
         "jsr:@std/assert@^1.0.7",
         "jsr:@std/data-structures",
-        "jsr:@std/fs",
+        "jsr:@std/fs@^1.0.5",
         "jsr:@std/internal",
         "jsr:@std/path@^1.0.8"
       ]
+    },
+    "@ts-morph/bootstrap@0.24.0": {
+      "integrity": "a826a2ef7fa8a7c3f1042df2c034d20744d94da2ee32bf29275bcd4dffd3c060",
+      "dependencies": [
+        "jsr:@ts-morph/common"
+      ]
+    },
+    "@ts-morph/common@0.24.0": {
+      "integrity": "12b625b8e562446ba658cdbe9ad77774b4bd96b992ae8bd34c60dbf24d06c1f3",
+      "dependencies": [
+        "jsr:@std/fs@~0.229.3",
+        "jsr:@std/path@~0.225.2"
+      ]
     }
   },
   "npm": {
@@ -52,18 +151,15 @@
         "undici-types"
       ]
     },
-    "test-console@2.0.0": {
-      "integrity": "sha512-ciILzfCQCny8zy1+HEw2yBLKus7LNMsAHymsp2fhvGTVh5pWE5v2EB7V+5ag3WM9aO2ULtgsXVQePWYE+fb7pA=="
-    },
     "undici-types@6.19.8": {
       "integrity": "sha512-ve2KP6f/JnbPBFyobGHuerC9g1FYGn/F8n1LWTwNxCEzd6IfqTwUQcNXgEtmmQ6DlRrC1hrSrBnCZPokRrDHjw=="
     }
   },
   "workspace": {
     "dependencies": [
-      "jsr:@std/assert@1",
-      "jsr:@std/testing@^1.0.4",
-      "npm:test-console@2"
+      "jsr:@deno/dnt@~0.41.3",
+      "jsr:@std/assert@^1.0.7",
+      "jsr:@std/testing@^1.0.4"
     ]
   }
 }
diff --git a/console_test.ts b/tests/_console_log_test.ts
similarity index 88%
rename from console_test.ts
rename to tests/_console_log_test.ts
index 921f46f..bc8f69f 100644
--- a/console_test.ts
+++ b/tests/_console_log_test.ts
@@ -1,12 +1,11 @@
 import { assertEquals } from "@std/assert";
-import { Secret } from "./mod.ts";
-
+import { Secret } from "../mod.ts";
 console.log(new Secret("password"));
 
 Deno.test("Secret - hidden from stdout and stderr", async () => {
   // spawn a process and verify that stdout is redacted
   const command = new Deno.Command("deno", {
-    args: ["console_test.ts"],
+    args: ["./tests/_console_log_test.ts"],
     stdout: "piped",
     stderr: "piped",
     stdin: "piped",
diff --git a/mod_test.ts b/tests/mod_test.ts
similarity index 97%
rename from mod_test.ts
rename to tests/mod_test.ts
index 022b5bf..8b8bf4c 100644
--- a/mod_test.ts
+++ b/tests/mod_test.ts
@@ -1,5 +1,5 @@
 import { assert, assertEquals, assertFalse, assertThrows } from "@std/assert";
-import { assertSecret, isSecret, Secret } from "./mod.ts";
+import { assertSecret, isSecret, Secret } from "../mod.ts";
 
 Deno.test("Secret - can expose", () => {
   const secret = new Secret("password");