token

package

v1.4.0 Latest Latest Go to latest Published: Nov 3, 2026 License: MIT Imports: 4 Imported by: 0

Details

Package token generates and hashes the random secrets used for sessions, email verification, and password resets.

A token is handed to the client exactly once. Only its SHA-256 hash is stored, so a database leak doesn't expose working tokens.

View Source

const Size = 32

Size is the number of random bytes in a token.

This section is empty.

func Equal(a, b []byte) bool

Equal reports whether two hashes are equal, in constant time.

func Hash(token string) []byte

Hash returns the SHA-256 hash of a token, for storage and lookup.

func New() string

New returns a new random token: Size bytes from crypto/rand, encoded as unpadded base64url so it's safe in headers, cookies, and URLs.

func Valid(s string) bool

Valid reports whether s has the exact shape of a token from New. It lets callers reject garbage input before doing a database lookup.

This section is empty.