diff --git a/README.md b/README.md
index a696026..e45ad55 100644
--- a/README.md
+++ b/README.md
@@ -6,6 +6,29 @@
 
 A library of utilities and types for SASjs written in TypeScript.
 
+## Entry points
+
+This is a Node library, and the barrel - `import { x } from '@sasjs/utils'` - is its Node
+entry point. Importing from it pulls in the modules that only Node can run: `fs-extra` and
+`@fast-csv/format` through `./file`, `prompts` through `./input`, `chalk` and `consola`
+through `./logger` and `./formatter`.
+
+Code that is bundled for a browser imports the subpath it needs instead:
+
+```
+import { ServerType } from '@sasjs/utils/types'
+import { prefixMessage } from '@sasjs/utils/error'
+import { isSpecialMissing } from '@sasjs/utils/input/validators'
+import { bytesToSize } from '@sasjs/utils/utils'
+```
+
+The hash and sync helpers - `getHash`, `compareHashes`, `extractHashArray`,
+`generateCompileProgram`, `generateProgramToGetRemoteHash`, `generateProgramToSyncHashDiff`
+and `findResourcesNotPresentLocally` - live in `@sasjs/utils/fs`. They hash files and
+folders on disk, so they are Node-only, and the barrel does not re-export them: a browser
+bundle that imports the barrel for anything else no longer reaches `crypto`, which used to
+arrive with the whole AES/RSA/ECDSA polyfill suite behind it.
+
 ## Contributors ✨
 
 Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/docs/en/emoji-key)):
diff --git a/src/index.spec.ts b/src/index.spec.ts
new file mode 100644
index 0000000..c63ec94
--- /dev/null
+++ b/src/index.spec.ts
@@ -0,0 +1,34 @@
+import * as barrel from './index'
+
+/**
+ * The helpers './fs' provides. They hash files and folders on disk, so they are
+ * Node-only, and the barrel must not carry them: re-exporting './fs' put the
+ * crypto chain - crypto-browserify, browserify-sign, parse-asn1, asn1.js,
+ * vm-browserify - into every browser bundle that imported anything from the
+ * barrel. See sasjs/utils#275.
+ */
+const NODE_ONLY_FS_HELPERS = [
+  'getHash',
+  'compareHashes',
+  'extractHashArray',
+  'generateCompileProgram',
+  'generateProgramToGetRemoteHash',
+  'generateProgramToSyncHashDiff',
+  'findResourcesNotPresentLocally'
+]
+
+describe('the barrel', () => {
+  it('does not re-export the node-only fs helpers', () => {
+    for (const name of NODE_ONLY_FS_HELPERS) {
+      expect(barrel).not.toHaveProperty(name)
+    }
+  })
+
+  it('leaves them reachable at the fs subpath', () => {
+    const fs = require('./fs')
+
+    for (const name of NODE_ONLY_FS_HELPERS) {
+      expect(typeof fs[name]).toBe('function')
+    }
+  })
+})
diff --git a/src/index.ts b/src/index.ts
index c3c20d1..3e5a55e 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -8,4 +8,9 @@ export * from './time'
 export * from './types'
 export * from './utils'
 export * from './compileTree'
-export * from './fs'
+// './fs' is deliberately absent: it is the only module here that imports
+// `crypto`, and re-exporting it put that - plus browserify-sign, parse-asn1,
+// asn1.js and vm-browserify, roughly 555 KB of AES/RSA/ECDSA polyfills and a
+// vm shim's dynamic code execution - into every browser bundle that imported
+// anything from this barrel. The helpers live at '@sasjs/utils/fs' instead.
+// See sasjs/utils#275.