Documentation
¶
Overview ¶
Package passwords provides bcrypt password hashing and strength validation.
Security:
- bcrypt with cost factor 12 (tunable)
- Constant-time comparison (built into bcrypt)
- No plaintext passwords ever stored or logged
Index ¶
Constants ¶
const ( // MinPasswordLength is the minimum acceptable password length. MinPasswordLength = 8 // MaxPasswordLength is bcrypt's maximum password byte length. MaxPasswordLength = 72 )
const ProductionBcryptCost = 12
ProductionBcryptCost is the bcrypt work factor used in production (≈250 ms on modern hardware). Lowering it is a security regression; the strength_security_test enforces it.
Variables ¶
This section is empty.
Functions ¶
func Hash ¶
Hash hashes a plaintext password using bcrypt with cost 12. The returned string is suitable for storage (e.g. "$2a$12$...").
func SetCostForTests ¶ added in v0.6.5
func SetCostForTests(cost int) (restore func())
SetCostForTests overrides the bcrypt cost factor for the duration of a test binary. Call ONLY from TestMain (before any tests run) or from a single test that immediately defers the returned restore func. It is not safe for concurrent use and must never be called from production code. Returns a restore func that resets the original cost.
func ValidateStrength ¶
ValidateStrength validates password strength and returns a list of issues. An empty slice means the password meets all requirements.
Types ¶
This section is empty.
Source Files