Go package to facilitate the use of the Argon2id password hashing algorithm from the "crypto/argon2" package.
go get "github.com/KEINOS/go-argonize"
func Example() {
// Your strong and unpredictable password
password := []byte("my password")
// Password hash your password
hashedObj, err := argonize.Hash(password)
if err != nil {
log.Fatal(err)
}
// View the hashed password
fmt.Println("Passwd to save:", hashedObj.String())
// Verify password (golden case)
if hashedObj.IsValidPassword([]byte("my password")) {
fmt.Println("the password is valid")
} else {
fmt.Println("the password is invalid")
}
// Verify password (wrong case)
if hashedObj.IsValidPassword([]byte("wrong password")) {
fmt.Println("the password is valid")
} else {
fmt.Println("the password is invalid")
}
// Output:
// Passwd to save: $argon2id$v=19$m=65536,t=1,p=2$ek6ZYdlRm2D5AsGV98TWKA$QAIDZEdIgwohrNX678mHc448LOmD7jGR4BGw/9YMMVU
// the password is valid
// the password is invalid
}
- View more examples and advanced usages @ pkg.go.dev
-
Q: "How can I recover the original password from a hashed password?"
- A: You can't. That is the purpose of hashes. You can only check if a password is valid. Note that hashes do not encrypt values.
-
Q: "If hashed passwords cannot be recovered, does this mean that hashed data is safe from theft?"
- A: No. Hashing is not synonymous with "theft protection". After password hashing, it is no longer possible to "calculate" the original password, but a brute force attack or rainbow table attack can find the original password. Argon2id is currently the strongest password hashing algorithm, but if a hashed password is stolen, it takes so long to crack it that it only buys time until the next countermeasure can be taken. This is true regardless of the algorithm used. The problem is that the system is designed to enable data theft. If you do not understand this dilemma, the only way to prevent data theft is to not store the data in the first place. It is a strong statement, but it's a question that comes up so often that we had to write about it. 😭
Any Pull-Request for improvement is welcome!
- Branch to PR:
main
-
CIs on PR/Push:
unit-tests
golangci-lint
codeQL-analysis
platform-tests
- Security policy
- MIT, Copyright (c) 2022 KEINOS and the go-Argonize contributors.
- This Go package is strongly influenced by an article by Alex Edwards.