password

package
v1.3.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 23, 2026 License: MIT Imports: 9 Imported by: 0

Documentation

Overview

Package password abstracts password hashing behind the Hasher interface and ships an Argon2id implementation as the secure default.

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ErrMismatch is returned by Hasher.Verify when the password does not match the hash.
	ErrMismatch = errors.New("password: hash and password do not match")
	// ErrInvalidHash is returned when an encoded hash cannot be parsed.
	ErrInvalidHash = errors.New("password: invalid encoded hash")
	// ErrIncompatibleVersion is returned when the hash was produced by another Argon2 version.
	ErrIncompatibleVersion = errors.New("password: incompatible argon2 version")
)
View Source 
var DefaultArgon2idParams = Argon2idParams{
	Memory:      19 * 1024,
	Iterations:  2,
	Parallelism: 1,
	SaltLength:  16,
	KeyLength:   32,
}

DefaultArgon2idParams follows the OWASP Password Storage recommendation (m=19 MiB, t=2, p=1).

Functions

func SetRandReaderForTesting 

func SetRandReaderForTesting(r io.Reader) func()

SetRandReaderForTesting overrides the entropy source during unit tests and returns a restore func.

Types

type Argon2id 

type Argon2id struct {
	// contains filtered or unexported fields
}

Argon2id is a Hasher producing PHC formatted strings: 

$argon2id$v=19$m=19456,t=2,p=1$<salt>$<key>

Verification reads parameters from the hash itself, so parameters can be raised over time without invalidating existing hashes.

func NewArgon2id 

func NewArgon2id(params Argon2idParams) *Argon2id

NewArgon2id returns an Argon2id hasher. Zero-valued fields fall back to DefaultArgon2idParams.

func (*Argon2id) Hash 

func (h *Argon2id) Hash(ctx context.Context, password string) (string, error)

Hash derives an Argon2id hash with a random salt.

func (*Argon2id) Verify 

func (h *Argon2id) Verify(ctx context.Context, encoded, password string) error

Verify compares a password against an encoded hash in constant time.

type Argon2idParams 

type Argon2idParams struct {
	Memory      uint32 // KiB
	Iterations  uint32
	Parallelism uint8
	SaltLength  uint32
	KeyLength   uint32
}

Argon2idParams configures the Argon2id hasher.

type Hasher 

type Hasher interface {
	Hash(ctx context.Context, password string) (string, error)
	Verify(ctx context.Context, hash, password string) error
}

Hasher hashes and verifies passwords. Implementations must be safe for concurrent use and must return ErrMismatch for wrong passwords.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.