pbkdf2-password-hash

hash password with pbkdf2

Generation and validation of passwords using PBKDF2 hashes.

Safety is obtained by using safe digest, large number of iterations and large key-length for PBKDF2. Per default uses sha512 with 512 bit key and 120,000 iterations.

This is as recommended by OWASP.

ToC

• Example
• API
  • hash(password, [salt], [opts])
  • compare(password, passwordHash)
• Migrating from v1
• Installation
• Tests
• LICENSE

Example

Generate new password hash

import passwordHash from 'pbkdf2-password-hash'

// generates random salt
passwordHash.hash('password')
  .then((hash) => {
    //> hash === 'sha512$120000$64$hBKkXNgl006VdFvQPyCawVYwdT78Uns1x0VnixvHHKfVzjS0Y0p58auWZ5AVV6MFGt/E1HaJ2MOqJSlKkaDspA==$zkq/ubSJoqflS23Ot5EkI6H+LE+D26p+6C0wtPHIr4HPVZPfXR/ZiflXAQ01b2uXCfHN8XUzOXWY9MqcvBYIog=='
  })

Generate password hash with different options

passwordHash.hash('password', {iterations: 100, digest: 'sha1', keylen: 16, saltlen: 16})
.then((hash) => {
  //> hash === 'sha1$100$16$fwzPKhZjCQSZMz+hY7A29A==$KdGdduxkKd08FDUuUVDVRQ=='
})

Validate password hash

const hash = 'sha512$120000$64$hBKkXNgl006VdFvQPyCawVYwdT78Uns1x0VnixvHHKfVzjS0Y0p58auWZ5AVV6MFGt/E1HaJ2MOqJSlKkaDspA==$zkq/ubSJoqflS23Ot5EkI6H+LE+D26p+6C0wtPHIr4HPVZPfXR/ZiflXAQ01b2uXCfHN8XUzOXWY9MqcvBYIog=='
passwordHash.compare('password', hash)
.then((isValid) => {
  //> isValid === true
})

API

hash(password, [salt], [opts])

Generate a new password hash for password using PBKDF2. Safety is obtained by using safe digest, large number of iterations and large key-length for PBKDF2

Parameters

parameter	type	description
password	String
[salt]	String	optional: salt
[opts.iterations=120000]	Number	optional: PBKDF2 number of iterations (~10 hashes/sec @ 2GHz)
[opts.digest=sha512]	String	optional: PBKDF2 digest
[opts.keylen=64]	Number	optional: PBKDF2 key length
[opts.saltlen=64]	Number	optional: salt length in case salt is not defined

Returns Promise, hashed password in <digest>$<iterations>$<keylen>$<salt>$<hash> notation

compare(password, passwordHash)

validate password against passwordHash

Parameters

parameter	type	description
password	String	plain-text password
passwordHash	String	hashed password

Returns Promise, true if hash matches password

Installation

Requires nodejs >= v6.0.0

$ npm install --save pbkdf2-password-hash

Tests

$ npm test

LICENSE

UNLICENSE https://unlicense.org