github.com/KEINOS/go-argonize

Argon2id Go package to facilitate the use of "crypto/argon2" package.


Keywords
argon2id, go, golang, golang-package, password-hashing
License
MIT
Install
go get github.com/KEINOS/go-argonize

Documentation

go-argonize

go1.22+ Go Reference

Go package to facilitate the use of the Argon2id password hashing algorithm from the "crypto/argon2" package.

go get "github.com/KEINOS/go-argonize"
func Example() {
    // Your strong and unpredictable password
    password := []byte("my password")

    // Password hash your password
    hashedObj, err := argonize.Hash(password)
    if err != nil {
        log.Fatal(err)
    }

    // View the hashed password
    fmt.Println("Passwd to save:", hashedObj.String())

    // Verify password (golden case)
    if hashedObj.IsValidPassword([]byte("my password")) {
        fmt.Println("the password is valid")
    } else {
        fmt.Println("the password is invalid")
    }

    // Verify password (wrong case)
    if hashedObj.IsValidPassword([]byte("wrong password")) {
        fmt.Println("the password is valid")
    } else {
        fmt.Println("the password is invalid")
    }

    // Output:
    // Passwd to save: $argon2id$v=19$m=65536,t=1,p=2$ek6ZYdlRm2D5AsGV98TWKA$QAIDZEdIgwohrNX678mHc448LOmD7jGR4BGw/9YMMVU
    // the password is valid
    // the password is invalid
}

FAQ

  • Q: "How can I recover the original password from a hashed password?"
    • A: You can't. That is the purpose of hashes. You can only check if a password is valid. Note that hashes do not encrypt values.
  • Q: "If hashed passwords cannot be recovered, does this mean that hashed data is safe from theft?"
    • A: No. Hashing is not synonymous with "theft protection". After password hashing, it is no longer possible to "calculate" the original password, but a brute force attack or rainbow table attack can find the original password. Argon2id is currently the strongest password hashing algorithm, but if a hashed password is stolen, it takes so long to crack it that it only buys time until the next countermeasure can be taken. This is true regardless of the algorithm used. The problem is that the system is designed to enable data theft. If you do not understand this dilemma, the only way to prevent data theft is to not store the data in the first place. It is a strong statement, but it's a question that comes up so often that we had to write about it. 😭

Statuses

UnitTests golangci-lint CodeQL-Analysis PlatformTests

codecov Go Report Card

Contributing

go1.22+ Go Reference Opened Issues PR

Any Pull-Request for improvement is welcome!

  • Branch to PR: main
  • CIs on PR/Push: unit-tests golangci-lint codeQL-analysis platform-tests
  • Security policy

License, copyright and credits