{"id":51784674,"url":"https://github.com/faustbrian/go-password","last_synced_at":"2026-07-20T16:31:20.765Z","repository":{"id":371797492,"uuid":"1302467455","full_name":"faustbrian/go-password","owner":"faustbrian","description":"Secure Argon2id and bcrypt password hashing, verification, and upgrade policy for Go.","archived":false,"fork":false,"pushed_at":"2026-07-17T01:52:42.000Z","size":83,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-17T03:07:44.804Z","etag":null,"topics":["argon2id","authentication","bcrypt","cryptography","go","golang","laravel","password","password-hashing","security"],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/faustbrian.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-07-16T07:28:36.000Z","updated_at":"2026-07-17T01:52:45.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/faustbrian/go-password","commit_stats":null,"previous_names":["faustbrian/go-password"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/faustbrian/go-password","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/faustbrian%2Fgo-password","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/faustbrian%2Fgo-password/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/faustbrian%2Fgo-password/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/faustbrian%2Fgo-password/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/faustbrian","download_url":"https://codeload.github.com/faustbrian/go-password/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/faustbrian%2Fgo-password/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35693381,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"ssl_error","status_checked_at":"2026-07-20T02:08:09.736Z","response_time":111,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["argon2id","authentication","bcrypt","cryptography","go","golang","laravel","password","password-hashing","security"],"created_at":"2026-07-20T16:31:19.855Z","updated_at":"2026-07-20T16:31:20.759Z","avatar_url":"https://github.com/faustbrian.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# go-password\n\n`go-password` is a narrowly scoped password hashing, verification, parsing,\nand login-time upgrade library. It uses maintained Go implementations of\nArgon2id and bcrypt. It does not own users, repositories, registration, login\nendpoints, sessions, password reset, MFA, authorization, or reversible secrets.\n\n## Requirements\n\n- Go 1.26.5 or newer.\n- `golang.org/x/crypto` v0.54.0.\n\n## Install\n\n```sh\ngo get github.com/faustbrian/go-password\n```\n\n## Five-minute Argon2id quickstart\n\n```go\npackage main\n\nimport (\n\t\"context\"\n\t\"errors\"\n\t\"fmt\"\n\n\tpassword \"github.com/faustbrian/go-password\"\n)\n\nfunc main() {\n\tpasswords, err := password.New(password.DefaultPolicy())\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\n\tencoded, err := passwords.Hash(\n\t\tcontext.Background(),\n\t\t[]byte(\"caller-owned password\"),\n\t)\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\n\tresult, err := passwords.Verify(\n\t\tcontext.Background(),\n\t\t[]byte(\"caller-owned password\"),\n\t\tencoded.String(), // explicit persistence access\n\t)\n\tif errors.Is(err, password.ErrMismatch) {\n\t\tfmt.Println(\"rejected\")\n\t\treturn\n\t}\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\tfmt.Println(result.Match(), result.NeedsRehash())\n}\n```\n\n`DefaultPolicy` uses Argon2id version 19, time 2, 64 MiB memory, one lane, a\n16-byte salt, and a 32-byte output. On an Apple M4 Max the measured one-shot\nbaseline is approximately 66 ms and 64 MiB per hash or verification. Benchmark\non deployment hardware before setting concurrency or pod limits.\n\n## Laravel migration\n\nUse `VerifyAndUpgrade` or `passwordauth.Authenticator` during successful login.\nLaravel `$2y$` bcrypt and PHC Argon2id strings are accepted. Never replace the\ndatabase value until verification succeeds and the new hash is durably written\nwith an optimistic comparison against the old value.\n\n```sql\nUPDATE users\nSET password_hash = $1\nWHERE id = $2\n  AND password_hash = $3;\n```\n\nTreat one affected row as success and zero as a benign concurrent update. See\nthe [Laravel migration guide](docs/laravel-migration.md) for complete Go and\nPostgreSQL examples.\n\n## Security defaults\n\n- Parser and primitive resources are bounded before expensive work.\n- Active and queued work have explicit hard limits and drainable lifecycle.\n- Argon2id verification uses constant-time derived-key comparison.\n- Bcrypt verification delegates to the maintained bcrypt primitive.\n- Rehash decisions never downgrade stronger parameters or Argon2id to bcrypt.\n- Production constructors use `crypto/rand.Reader`; deterministic entropy is\n  visibly test-only.\n- Password slices are copied and not retained. Best-effort clearing of the copy\n  is not a guarantee of runtime memory erasure.\n- `EncodedHash.String()` is explicit persistence access; all `fmt` formatting\n  is redacted.\n- Observations contain bounded enums, upgrade state, and duration only.\n\n## Packages\n\n| Package | Purpose |\n| --- | --- |\n| root | Policy, limits, parsing, admission, service, errors, observations |\n| `argon2id` | Argon2id service constructors |\n| `bcrypt` | Bcrypt compatibility constructors |\n| `passwordauth` | Application lookup and explicit CAS upgrade adapter |\n| `passwordservice` | Admission lifecycle hooks |\n| `passwordtest` | Synthetic fixtures and deterministic test entropy |\n\n## Documentation\n\n- [API and error semantics](docs/api.md)\n- [Encoded-hash grammar](docs/parser-grammar.md)\n- [Laravel migration](docs/laravel-migration.md)\n- [Database upgrades and concurrency](docs/database-upgrades.md)\n- [Kubernetes sizing and performance](docs/kubernetes-sizing.md)\n- [Threat model](docs/threat-model.md)\n- [Security and secret handling](docs/secret-handling.md)\n- [Testing and release gates](docs/testing.md)\n- [Release evidence and external gates](docs/release-evidence.md)\n- [Compatibility matrix](docs/compatibility.md)\n- [Vector and fixture provenance](docs/vector-provenance.md)\n- [FAQ](docs/faq.md) and [troubleshooting](docs/troubleshooting.md)\n\n## License\n\nMIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffaustbrian%2Fgo-password","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffaustbrian%2Fgo-password","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffaustbrian%2Fgo-password/lists"}