Package

passwords

Password policy after NIST SP 800-63B, and Argon2id hashing

0.1.0 MIT

Install

sspur add passwords@^0.1.0

or in sspur.toml:

passwords = { version = "^0.1.0" }

README

passwords

Password policy and storage for SSPUR, after NIST SP 800-63B: a length range, no well-known passwords, nothing built from the account's own name, and Argon2id hashes.

use passwords.{default_policy, problem, hash, verify}

fn sign_up(email: Str, pw: Str) -> Res[Str, Str] ! rand
= match problem(default_policy(), pw, [email])
  | some(why) => err(why)
  | none => ok(hash(secret(pw)))
  • problem(policy, password, avoid) says what is wrong with a password, or none. avoid lists words it must not be built from, such as the email or user name.
  • hash(password) returns an Argon2id hash with a random salt, and verify(password, stored) checks one in constant time.
  • needs_rehash(stored) tells when a stored hash uses older parameters, so it can be upgraded at the next login.

Install

sspur add passwords

MIT licensed. Part of the web app that sspur new web-app creates.

API

Policy type 

pub type Policy = {min: Int where _ >= 8, max: Int where _ >= 64 and _ <= 1024} derive Eq, Show

How long a password must and may be.

problem fn 

fn problem(p: Policy, pw: Str, avoid: List[Str]) -> Opt[Str]

Why pw is not acceptable under p, or none. avoid holds words the password must not contain, such as the user's email address and the site's name.

hash fn 

fn hash(pw: Secret[Str]) -> Str ! rand

An Argon2id hash of pw with a random salt, as a PHC string.

verify fn 

fn verify(pw: Secret[Str], stored: Str) -> Bool

Whether pw matches stored, in constant time.

needs_rehash fn 

fn needs_rehash(stored: Str) -> Bool

Whether stored was made with weaker parameters than hash uses now, so it should be replaced the next time the password is known.

Versions

VersionPublishedCommitSourceEffects
0.1.0 2026-10-16bcf011b00bsnapshot