@lacspace/password

Password hashing & verification — PBKDF2 with a portable PHC string.

Hash and verify passwords with PBKDF2-HMAC-SHA256 (600,000 iterations by default, per OWASP) over Web Crypto — correct and isomorphic. Self-describing PHC string, constant-time verify, rehash detection and a strength estimator. Never store plaintext.

• 🔒 hash / verify (constant-time) with a portable $pbkdf2-sha256$… string
• ♻️ needsRehash — upgrade work factor on next login
• 📏 strength — quick 0–4 score with warnings
• ⚡ Zero deps (bar @lacspace/crypto) · 🌍 isomorphic · fully typed

Install

npm install @lacspace/password

Usage

import { hash, verify, needsRehash, strength } from "@lacspace/password";

const stored = await hash("correct horse battery staple");
// "$pbkdf2-sha256$i=600000$<salt>$<hash>"  — store this string

await verify("correct horse battery staple", stored); // true
await verify("wrong", stored);                          // false

if (needsRehash(stored)) { /* re-hash with current params after a successful login */ }

strength("password");        // { score: 0, warnings: ["This is a very common password."] }
strength("Tr0ub4dour&3xy");  // { score: 4, warnings: [] }

API

| Export | Description | | --- | --- | | hash(password, opts?) | PHC-string hash (iterations, saltBytes) | | verify(password, stored) | constant-time check | | needsRehash(stored, iterations?) | true if below target work factor | | strength(password) | { score, length, warnings } |

The Lacspace Security Kit

| Package | For | | --- | --- | | @lacspace/crypto | AES encryption & hashing | | @lacspace/password | Password hashing (this package) | | @lacspace/jwt | JWTs & tokens | | @lacspace/apikey | API keys | | @lacspace/otp | TOTP/HOTP 2FA | | @lacspace/webauthn | Passkeys / biometric | | @lacspace/mfa | 2FA/3FA orchestration | | @lacspace/lock | Account lockout | | @lacspace/headers | Secure headers / CSP | | @lacspace/redact | Log redaction |

Licensing

This package is free under the Lacspace Free Licence — MIT-equivalent freedoms. Use it in personal and commercial projects at no cost; just keep the notice.

Not every Lacspace package is free. We also offer Commercial (paid), Client-specific, and Private (proprietary) packages under separate terms. See the full Lacspace Licence Centre.

Part of the Lacspace ecosystem — 35 zero-dependency, isomorphic TypeScript packages.

All packages ↗ · npm org ↗ · Licence Centre ↗ · GitHub ↗