@eryx/crypto/hazmat/argon2 ModuleArgon2 password hashing.
Provides the three Argon2 variants:
Each variant is available in two forms:
*_hash_raw: returns the raw derived bytes as a buffer*_hash_encoded: returns the PHC string form such as
"$argon2id$v=19$m=65536,t=3,p=4$..."The encoded form is the one you usually want to store in a database, since it embeds the variant and cost parameters. Use verify_encoded to check a password against one of those strings.
local argon2 = require("@eryx/crypto/hazmat/argon2")
local random = require("@eryx/crypto/hazmat/random")
local password = buffer.fromstring("hunter2")
local salt = random.bytes(16)
local encoded = argon2.argon2id_hash_encoded(password, salt, 3, 65536, 1, 32)
assert(argon2.verify_encoded(encoded, password))
Hashes a password with Argon2d and returns the raw hash bytes.
Argon2d uses data-dependent memory access, making it a poor default for password hashing on shared hardware, but it can be useful for specialised proof-of-work or side-channel-free environments.
Password or secret to hash.
Unique salt. Argon2 requires at least 8 bytes; 16+ bytes is a sensible default.
Number of passes over memory.
Memory cost in KiB.
Number of lanes/threads to request.
Desired raw output length in bytes.
Argon2 version. Defaults to VERSION_NUMBER.
Raw hash output.
Hashes a password with Argon2i and returns the raw hash bytes.
Argon2i uses data-independent memory access and is safer in the presence of timing/cache-observation attacks, but it is usually not the first choice now that Argon2id exists.
Password or secret to hash.
Unique salt.
Number of passes over memory.
Memory cost in KiB.
Number of lanes/threads to request.
Desired raw output length in bytes.
Argon2 version. Defaults to VERSION_NUMBER.
Raw hash output.
Hashes a password with Argon2id and returns the raw hash bytes.
Argon2id is the recommended general-purpose Argon2 mode for password hashing.
Password or secret to hash.
Unique salt.
Number of passes over memory.
Memory cost in KiB.
Number of lanes/threads to request.
Desired raw output length in bytes.
Argon2 version. Defaults to VERSION_NUMBER.
Raw hash output.
Hashes a password with Argon2d and returns the PHC encoded string.
This is the storage-friendly string form containing the variant, version, cost parameters, salt, and hash.
Password or secret to hash.
Unique salt.
Number of passes over memory.
Memory cost in KiB.
Number of lanes/threads to request.
Desired raw output length in bytes.
Argon2 version. Defaults to VERSION_NUMBER.
Encoded Argon2 hash string.
Hashes a password with Argon2i and returns the PHC encoded string.
Password or secret to hash.
Unique salt.
Number of passes over memory.
Memory cost in KiB.
Number of lanes/threads to request.
Desired raw output length in bytes.
Argon2 version. Defaults to VERSION_NUMBER.
Encoded Argon2 hash string.
Hashes a password with Argon2id and returns the PHC encoded string.
This is the usual API you want for password storage.
Password or secret to hash.
Unique salt.
Number of passes over memory.
Memory cost in KiB.
Number of lanes/threads to request.
Desired raw output length in bytes.
Argon2 version. Defaults to VERSION_NUMBER.
Encoded Argon2 hash string.
Verifies a password against an encoded Argon2 hash string.
The variant is inferred from the encoded PHC prefix, so the same function works for Argon2d, Argon2i, and Argon2id encoded hashes.
Encoded PHC hash string.
Password to test.
true if the password matches.
Returns the maximum encoded string length for the given parameters.
This can be useful when pre-allocating storage or validating size
limits before calling one of the *_hash_encoded functions.
Number of passes over memory.
Memory cost in KiB.
Number of lanes/threads.
Salt length in bytes.
Raw hash length in bytes.
One of "argon2d", "argon2i", or "argon2id".
Maximum encoded string length including the trailing NUL used by the underlying C API.
argon2.VERSION_10 = 16argon2.VERSION_13 = 19argon2.VERSION_NUMBER = 19