{"id":15905752,"url":"https://github.com/alexandrevicenzi/unchained","last_synced_at":"2025-10-06T01:44:01.854Z","repository":{"id":57480583,"uuid":"54247122","full_name":"alexandrevicenzi/unchained","owner":"alexandrevicenzi","description":"Secure password hashers for Go compatible with Django","archived":false,"fork":false,"pushed_at":"2023-02-25T04:05:07.000Z","size":59,"stargazers_count":58,"open_issues_count":2,"forks_count":9,"subscribers_count":5,"default_branch":"master","last_synced_at":"2025-09-01T14:49:17.484Z","etag":null,"topics":["argon2","bcrypt","django","django-hashers","go","golang","hashes","password","password-hash","pbkdf2"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/alexandrevicenzi.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":null,"patreon":null,"open_collective":null,"ko_fi":null,"tidelift":null,"community_bridge":null,"liberapay":null,"issuehunt":null,"otechie":null,"custom":"https://www.alexandrevicenzi.com/donate"}},"created_at":"2016-03-19T04:20:30.000Z","updated_at":"2025-05-29T03:07:31.000Z","dependencies_parsed_at":"2024-06-18T16:40:48.891Z","dependency_job_id":"04d3283b-dcd7-4818-bd86-efcdbbbf7c66","html_url":"https://github.com/alexandrevicenzi/unchained","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/alexandrevicenzi/unchained","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexandrevicenzi%2Funchained","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexandrevicenzi%2Funchained/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexandrevicenzi%2Funchained/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexandrevicenzi%2Funchained/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/alexandrevicenzi","download_url":"https://codeload.github.com/alexandrevicenzi/unchained/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexandrevicenzi%2Funchained/sbom","scorecard":{"id":180675,"data":{"date":"2025-08-11","repo":{"name":"github.com/alexandrevicenzi/unchained","commit":"0321d6e836864d4c4a5fccbd202ad61b59ecc104"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":1.7,"checks":[{"name":"Token-Permissions","score":-1,"reason":"No tokens found","details":null,"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Maintained","score":0,"reason":"0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Code-Review","score":1,"reason":"Found 4/28 approved changesets -- score normalized to 1","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Dangerous-Workflow","score":-1,"reason":"no workflows found","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: BSD 3-Clause \"New\" or \"Revised\" License: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: containerImage not pinned by hash: Dockerfile:1: pin your Docker image by updating golang:1.13 to golang:1.13@sha256:8ebb6d5a48deef738381b56b1d4cd33d99a5d608e0d03c5fe8dfa3f68d41a1f8","Info:   0 out of   1 containerImage dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 6 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}},{"name":"Vulnerabilities","score":0,"reason":"10 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GO-2022-0229 / GHSA-cjjc-xp8v-855w","Warn: Project is vulnerable to: GO-2020-0012 / GHSA-ffhg-7mh4-33c4","Warn: Project is vulnerable to: GO-2021-0227 / GHSA-3vm4-22fp-5rfm","Warn: Project is vulnerable to: GO-2022-0968 / GHSA-gwc9-m7rh-j2ww","Warn: Project is vulnerable to: GO-2021-0356 / GHSA-8c26-wmh5-6g9v","Warn: Project is vulnerable to: GO-2024-2961","Warn: Project is vulnerable to: GO-2023-2402 / GHSA-45x7-px36-x8w8","Warn: Project is vulnerable to: GO-2024-3321 / GHSA-v778-237x-gjrc","Warn: Project is vulnerable to: GO-2025-3487 / GHSA-hcg3-q754-cr77","Warn: Project is vulnerable to: GO-2022-0493 / GHSA-p782-xgp4-8hr8"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-16T18:48:43.299Z","repository_id":57480583,"created_at":"2025-08-16T18:48:43.299Z","updated_at":"2025-08-16T18:48:43.299Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":278547873,"owners_count":26004773,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-05T02:00:06.059Z","response_time":54,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["argon2","bcrypt","django","django-hashers","go","golang","hashes","password","password-hash","pbkdf2"],"created_at":"2024-10-06T13:08:20.571Z","updated_at":"2025-10-06T01:44:01.838Z","avatar_url":"https://github.com/alexandrevicenzi.png","language":"Go","funding_links":["https://www.alexandrevicenzi.com/donate"],"categories":[],"sub_categories":[],"readme":"# Unchained\n\n[![Build Status](https://travis-ci.org/alexandrevicenzi/unchained.svg?branch=master)](https://travis-ci.org/alexandrevicenzi/unchained)\n[![GoDoc](https://godoc.org/github.com/alexandrevicenzi/unchained?status.svg)](http://godoc.org/github.com/alexandrevicenzi/unchained)\n[![Go Report Card](https://goreportcard.com/badge/github.com/alexandrevicenzi/unchained)](https://goreportcard.com/report/github.com/alexandrevicenzi/unchained)\n\nSecure password hashers for Go compatible with [Django Password Hashers](https://docs.djangoproject.com/en/3.0/topics/auth/passwords/).\n\nUnchained can also be used to perform password validation against legacy or shared Django databases.\n\n## Install\n\nRequires Go 1.9 or higher.\n\n```\ngo get github.com/alexandrevicenzi/unchained\n```\n\n## Supported Hashers\n\n| Hasher | Encode | Decode | Dependencies |\n|:-------|:------:|:------:|:------------:|\n| Argon2        | ✔ | ✔ | [golang.org/x/crypto/argon2](https://godoc.org/golang.org/x/crypto/argon2) |\n| BCrypt        | ✔ | ✔ | [golang.org/x/crypto/bcrypt](https://godoc.org/golang.org/x/crypto/bcrypt) |\n| BCrypt SHA256 | ✔ | ✔ | [golang.org/x/crypto/bcrypt](https://godoc.org/golang.org/x/crypto/bcrypt) |\n| Crypt         | ✘ | ✘ |  |\n| MD5           | ✔ | ✔ |  |\n| PBKDF2 SHA1   | ✔ | ✔ | [golang.org/x/crypto/pbkdf2](https://godoc.org/golang.org/x/crypto/pbkdf2) |\n| PBKDF2 SHA256 | ✔ | ✔ | [golang.org/x/crypto/pbkdf2](https://godoc.org/golang.org/x/crypto/pbkdf2) |\n| SHA1          | ✔ | ✔ |  |\n| Unsalted MD5  | ✔ | ✔ |  |\n| Unsalted SHA1 | ✔ | ✔ |  |\n\n## Notes\n\nCrypt support is not planned because it's UNIX only.\n\nBCrypt hasher does not allow to set custom salt as in Django.\nIf you encode the same password multiple times you will get different hashes.\nThis limitation comes from [golang.org/x/crypto/bcrypt](https://godoc.org/golang.org/x/crypto/bcrypt) library.\n\n## Examples\n\n### Encode password\n\n```go\npackage main\n\nimport \"github.com/alexandrevicenzi/unchained\"\n\nfunc main() {\n    hash, err := unchained.MakePassword(\"my-password\", unchained.GetRandomString(12), \"default\")\n\n    if err == nil {\n        fmt.Println(hash)\n    } else {\n        fmt.Printf(\"Error encoding password: %s\\n\", err)\n    }\n}\n```\n\n### Validate password\n\n```go\npackage main\n\nimport \"github.com/alexandrevicenzi/unchained\"\n\nfunc main() {\n    valid, err := unchained.CheckPassword(\"admin\", \"pbkdf2_sha256$24000$JMO9TJawIXB1$5iz40fwwc+QW6lZY+TuNciua3YVMV3GXdgkhXrcvWag=\")\n\n    if valid {\n        fmt.Println(\"Password is valid.\")\n    } else {\n        if err == nil {\n            fmt.Println(\"Password is invalid.\")\n        } else {\n            fmt.Printf(\"Error decoding password: %s\\n\", err)\n        }\n    }\n}\n```\n\n## License\n\nBSD\n\n## Reference\n\n- [Password management in Django](https://docs.djangoproject.com/en/3.0/topics/auth/passwords/)\n- [Django Unchained](http://www.imdb.com/title/tt1853728/) :trollface:\n\n## Related Links\n\n- [Django compatible signing for Go](https://gitlab.com/pennersr/djgo/) (`django.core.signing`)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Falexandrevicenzi%2Funchained","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Falexandrevicenzi%2Funchained","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Falexandrevicenzi%2Funchained/lists"}