loginflow

Password authentication + login-flow helper for Node.js. Zero dependencies. Hash and verify passwords with Node's scrypt, and guard against brute-force login attempts with an in-memory failed-attempt lockout tracker.

Pricing

Free. MIT-licensed, open source. No fees, no tiers.

Install

npm install loginflow

Usage

const { hashPassword, verifyPassword, createLoginTracker } = require("loginflow");

// --- Password hashing & verification ---
const hash = hashPassword("correct horse battery staple");
// => "scrypt$16384$8$1$<salt>$<key>"

verifyPassword("correct horse battery staple", hash); // true
verifyPassword("wrong", hash);                         // false

// --- Brute-force lockout tracking ---
const tracker = createLoginTracker({ maxAttempts: 3, lockoutMs: 60_000 });

function attemptLogin(username, password) {
  if (tracker.isLocked(username)) {
    return { ok: false, locked: true, retryAfter: tracker.retryAfter(username) };
  }
  const ok = verifyPassword(password, findUserHash(username));
  if (ok) {
    tracker.success(username);
    return { ok: true };
  }
  const state = tracker.failed(username);
  return { ok: false, locked: state.locked, remaining: state.failures };
}

API

• hashPassword(password, { N, r, p, keylen }) → scrypt hash string
• verifyPassword(password, storedHash) → boolean (timing-safe)
• createLoginTracker({ maxAttempts, lockoutMs }) → tracker
  • failed(username) · success(username) · isLocked(username) · stateOf(username) · retryAfter(username)

License

MIT © shinnjr