RustCrypto: Password Hashes

Collection of password hashing algorithms, otherwise known as password-based key derivation functions, written in pure Rust.

Supported Algorithms

Algorithm	Crate	Crates.io	Documentation	MSRV
[Argon2]	[argon2]			![MSRV 1.85][msrv-1.85]
[Balloon]	[balloon‑hash]			![MSRV 1.85][msrv-1.85]
[bcrypt‑pbkdf]	[bcrypt‑pbkdf]			![MSRV 1.85][msrv-1.85]
[PBKDF2]	[pbkdf2]			![MSRV 1.85][msrv-1.85]
[scrypt]	[scrypt]			![MSRV 1.85][msrv-1.85]
[SHA-crypt]	[sha‑crypt]			![MSRV 1.85][msrv-1.85]
[yescrypt]	[yescrypt]			![MSRV 1.85][msrv-1.85]

Please see the [OWASP Password Storage Cheat Sheet] for assistance in selecting an appropriate algorithm for your use case.

Usage

The following code example shows how to verify a password when stored using one of many possible password hashing algorithms implemented in this repository.

# fn main() -> Result<(), Box<dyn core::error::Error>> {
use password_hash::{PasswordVerifier, PasswordHash};

use argon2::Argon2;
use pbkdf2::Pbkdf2;
use scrypt::Scrypt;

// Can be: `$argon2`, `$pbkdf2`, or `$scrypt`
let hash_string = "$argon2i$v=19$m=65536,t=1,p=1$c29tZXNhbHQAAAAAAAAAAA$+r0d29hqEB0yasKr55ZgICsQGSkl0v0kgwhd+U3wyRo";
let input_password = "password";

let password_hash = PasswordHash::new(&hash_string)?;

// Trait objects for algorithms to support
let algs: &[&dyn PasswordVerifier<PasswordHash>] = &[
    &Argon2::default(),
    &Pbkdf2::default(),
    &Scrypt::default()
];

for alg in algs {
    if alg.verify_password(input_password.as_ref(), &password_hash).is_ok() {
        return Ok(());
    }
}

// If we get here, the password is invalid
# Err(Box::new(password_hash::Error::PasswordInvalid))
# }

Minimum Supported Rust Version (MSRV) Policy

MSRV bumps are considered breaking changes and will be performed only with minor version bump.

License

All crates licensed under either of

• Apache License, Version 2.0
• MIT license

at your option.

Contribution

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.