Hashing and verifying user passwords with PBKDF2 (Web Crypto), no native modules.
Overview
Hash & verify with PBKDF2-HMAC-SHA256 (600k iterations per OWASP) in a portable PHC string, constant-time verify, rehash detection and a strength estimator. Never store plaintext.
Install
$ npm install @lacspace/password
Quick example
@lacspace/passwordts
await verify(input, storedHash)
Returns true / false
Tips
`hashPassword()` embeds the salt and parameters in the output string, so `verifyPassword()` needs nothing else.
Pair with @lacspace/lock to throttle brute-force attempts.
Zero-dependency and isomorphic — safe to import on the server, in the browser, on the edge and in React Native. It tree-shakes, so you only ship what you import.
Watch out for
Verification is intentionally slow (that's the point). Do it off the hot path and rate-limit login endpoints.
