argon2-ffi supports NodeJS LTS releases and the current NodeJS release.
Calling CPU-intensive tasks like password hashing and validation are performed
asynchronously by dispatching the work to a separate thread pool using
node-ffi, which in turn uses
libuv, so your main
application can continue to do other work while these tasks are executed. All
asynchronous operations return Promises, with a type defined by
npm install --save argon2-ffi
This module exports
argon2d. These are two variants
argon2 with different use-cases and tradeoffs. To find which
one you should use, refer to the
Hashing a password
var argon2i = argon2i;// var argon2d = require('argon2-ffi').argon2d; if you'd like to use argon2dvar crypto = ;var Promise = ;var randomBytes = Promise;var password = 'password1'; // Can also be a Buffer; // $argon2i$v=19$m=4096,t=3,p=1$c2FsdHlzYWx0$oG0js25z7kM30xSg9+nAKtU0hrPa0UnvRnqQRZXHCV8
In this example, crypto.randomBytes is used to generate a salt. This is the best practice as the salt is guaranteed to be cryptographically secure. However, you can of course use your own buffer.
.hash takes a few options, too! You can specify
32). Changing any of these parameters will
have an effect on the output hash.
var argon2i = argon2i;var crypto = ;var Promise = ;var randomBytes = Promise;var password = 'password1';var options = timeCost: 4 memoryCost: 1 << 14 parallelism: 2 hashLength: 64 ;; // $argon2i$v=19$m=16384,t=4,p=2$c2FsdHlzYWx0$gwJY/FsXNSR3aS1ChVTgDZ9HbF3V7sbbYE5UmQsdXFHB4Tt6/RVtFWGIIJnzZ62nL9miurrvJnxhvORK64ddFg
The result of running
.hash is a string that encodes all of the options used
to produce the hash, so to verify passwords later, this string is all you need,
as we'll see in the next section.
Verifying a password
var argon2i = argon2i;var encodedHash = "$argon2i$v=19$m=4096,t=3,p=1$c2FsdHlzYWx0$oG0js25z7kM30xSg9+nAKtU0hrPa0UnvRnqQRZXHCV8";var password = 'password1';argon2i;
Differences from node-argon2
argon2-ffi was originally written to address an issue
node-argon2 in a web server. This was a
non-starter for my own projects. By using
argon2-ffi was able to
circumvent the problems
node-argon2 had with Promises.
since resolved this issue.
argon2-ffi also returned Promises with
any-promise, but this has since been implemented in
node-argon2 as well.
Today, the practical differences between the two libraries are only in the
git submodule init git submodule update node-gyp rebuild npm run build