go-argonize

Go package to facilitate the use of the Argon2id password hashing algorithm from the "crypto/argon2" package.

go get "github.com/KEINOS/go-argonize"

func Example() {
    // Your strong and unpredictable password
    password := []byte("my password")

    // Password hash your password
    hashedObj, err := argonize.Hash(password)
    if err != nil {
        log.Fatal(err)
    }

    // View the hashed password
    fmt.Println("Passwd to save:", hashedObj.String())

    // Verify password (golden case)
    if hashedObj.IsValidPassword([]byte("my password")) {
        fmt.Println("the password is valid")
    } else {
        fmt.Println("the password is invalid")
    }

    // Verify password (wrong case)
    if hashedObj.IsValidPassword([]byte("wrong password")) {
        fmt.Println("the password is valid")
    } else {
        fmt.Println("the password is invalid")
    }

    // Output:
    // Passwd to save: $argon2id$v=19$m=65536,t=1,p=2$ek6ZYdlRm2D5AsGV98TWKA$QAIDZEdIgwohrNX678mHc448LOmD7jGR4BGw/9YMMVU
    // the password is valid
    // the password is invalid
}

View more examples and advanced usages @ pkg.go.dev

FAQ

Q: "How can I recover the original password from a hashed password?"
- A: You can't. That is the purpose of hashes. You can only check if a password is valid. Note that hashes do not encrypt values.
Q: "If hashed passwords cannot be recovered, does this mean that hashed data is safe from theft?"
- A: No. Hashing is not synonymous with "theft protection". After password hashing, it is no longer possible to "calculate" the original password, but a brute force attack or rainbow table attack can find the original password. Argon2id is currently the strongest password hashing algorithm, but if a hashed password is stolen, it takes so long to crack it that it only buys time until the next countermeasure can be taken. This is true regardless of the algorithm used. The problem is that the system is designed to enable data theft. If you do not understand this dilemma, the only way to prevent data theft is to not store the data in the first place. It is a strong statement, but it's a question that comes up so often that we had to write about it. 😭