node package manager
Loosely couple your services. Use Orgs to version and reuse your code. Create a free org ยป



Easily and securely hash passwords with a variable amount of iterations of SHA512.

You can also specify to use bcrypt and the number of rounds to use.

Takes in an optional username and number of iterations and then prompts for a password.

If a username or number of iterations/rounds is not provided it will prompt for them.


npm install -g passhash


-t, --hash-type <number>         1 for SHA512 or 2 for bcrypt
-i, --iterations <number>        number of SHA512 iterations (default is set to 5000)
-r, --rounds <number>            number of rounds for bcrypt
-b, --bytes <number>             number of bytes to use for crypto random salt, must be >= 128 (default 128)
-h, --help                       print this message and exit
-u, --username <name>            username to use for entry
-U, --updates                    check for available updates
-f, --format                     change format of output. Not supported if using bcrypt as hash type
-v, --version                    print the version number and exit

Default Output







Change Output Format

passhash allows the user to define the output. For output to be useful it should include at least the username, the salt, and the hash.

Changing the format is easy. passhash has built in keywords: {username} {salt} {hash} and {iterations}. By default they are printed out : delimited. For example if you didn't want to output the number of iterations:

node passhash.js -f '{username}<<>>{salt}<<>>{hash}'

This would output:


Example Prompt

alex @ [ kovas :: (Darwin) ] ~/Projects/passhash $ ./passhash.js
passhash: Enter 1 for SHA512 or 2 for bcrypt:  2
passhash: username:  test
passhash: Please enter a password:
passhash: Please re-enter your password:
passhash: Number of iterations for SHA512 or number of rounds for bcrypt :  10


I personally dislike how people do authentication on the web. htpasswd can easily be broken. passhash allows for a more robust password storage system. Now you can store the output of passhash into a file and code your node server to use it for authentication, eliminating the need for htaccess/htpasswd. For added security you can choose a number of iterations and not store it in the file, using it only in your server code for the password validation. Each user could also have a different number of iterations. Is this still somewhat insecure? Yes, someone could take a line from the file and if the user choose a weak password and the attacker knew the number of iterations and the salt they could still use brute force. You can't protect against stupid users. That is why I have added in bcrypt support in the latest release.