Hash and verify a password snippet

const bcrypt = require('bcryptjs'); // bcryptjs = pure JS; bcrypt = faster native

async function hashPassword(plain) {
  return bcrypt.hash(plain, 12); // $2b$12$<salt+digest> — one self-describing string
}

async function verifyPassword(plain, stored) {
  return bcrypt.compare(plain, stored); // boolean; salt+cost parsed from `stored`
}

import { hash, compare } from 'bcryptjs'; // or: import * as argon2 from 'argon2'

export async function hashPassword(plain: string): Promise<string> {
  return hash(plain, 12);
}

export async function verifyPassword(plain: string, stored: string): Promise<boolean> {
  return compare(plain, stored);
}

import "golang.org/x/crypto/bcrypt"

const passwordCost = 12 // log2 rounds — the ONE place to tune

func HashPassword(pw string) (string, error) {
	b, err := bcrypt.GenerateFromPassword([]byte(pw), passwordCost)
	return string(b), err
}

func VerifyPassword(pw, stored string) bool {
	return bcrypt.CompareHashAndPassword([]byte(stored), []byte(pw)) == nil // nil = match
}

use argon2::{
    password_hash::{rand_core::OsRng, PasswordHash, PasswordHasher, PasswordVerifier, SaltString},
    Argon2,
};

fn hash_password(plain: &str) -> Result<String, argon2::password_hash::Error> {
    let salt = SaltString::generate(&mut OsRng);
    Ok(Argon2::default() // Argon2id v19: m=19456 KiB, t=2, p=1 (OWASP baseline)
        .hash_password(plain.as_bytes(), &salt)?
        .to_string())
}

fn verify_password(plain: &str, stored: &str) -> Result<bool, argon2::password_hash::Error> {
    let parsed = PasswordHash::new(stored)?;
    Ok(Argon2::default().verify_password(plain.as_bytes(), &parsed).is_ok())
}

$stored = password_hash($pw, PASSWORD_DEFAULT); // argon2id if compiled in, else bcrypt

if (password_verify($pw, $stored)) {              // boolean, constant-time inside
    if (password_needs_rehash($stored, PASSWORD_DEFAULT)) {
        $stored = password_hash($pw, PASSWORD_DEFAULT); // transparent upgrade on login
    }
    // credentials OK — proceed with the session
}

import hashlib, hmac, os

def hash_password(pw: str) -> str:
    salt = os.urandom(16)
    dk = hashlib.scrypt(pw.encode(), salt=salt, n=2**14, r=8, p=1, dklen=32)
    return f"scrypt$16384$8$1${salt.hex()}${dk.hex()}"  # you own this envelope

def verify_password(pw: str, stored: str) -> bool:
    algo, n, r, p, salt_hex, dk_hex = stored.split('$')
    dk = hashlib.scrypt(pw.encode(), salt=bytes.fromhex(salt_hex),
                        n=int(n), r=int(r), p=int(p), dklen=len(dk_hex) // 2)
    return hmac.compare_digest(dk.hex(), dk_hex)  # constant-time, never ==

using Microsoft.AspNetCore.Identity;

var hasher = new PasswordHasher<AppUser>();

string stored = hasher.HashPassword(user, pw); // PBKDF2-HMAC-SHA256, 100k iterations

var result = hasher.VerifyHashedPassword(user, stored, pw);
if (result == PasswordVerificationResult.SuccessRehashNeeded)
    stored = hasher.HashPassword(user, pw);     // upgrade the old hash at login

import org.mindrot.jbcrypt.BCrypt;

static String hashPassword(String plain) {
    return BCrypt.hashpw(plain, BCrypt.gensalt(12)); // $2a$12$...
}

static boolean verifyPassword(String plain, String stored) {
    return BCrypt.checkpw(plain, stored);
}

// Spring Security alternative — the {bcrypt} id prefix rides in the string:
// PasswordEncoder e = PasswordEncoderFactories.createDelegatingPasswordEncoder();
// e.encode(pw);            // "{bcrypt}$2a$12$..."
// e.matches(pw, stored);   // e.upgradeEncoding(stored) → re-hash on login

import CommonCrypto
import Foundation

func deriveKey(password: String, salt: Data, rounds: UInt32 = 100_000) -> Data {
    var derived = Data(repeating: 0, count: 32)
    let pw = password.data(using: .utf8)!
    let status = derived.withUnsafeMutableBytes { dk in
        salt.withUnsafeBytes { s in
            pw.withUnsafeBytes { p in
                CCKeyDerivationPBKDF(
                    CCPBKDFAlgorithm(kCCPBKDF2),
                    p.bindMemory(to: Int8.self).baseAddress, pw.count,
                    s.bindMemory(to: UInt8.self).baseAddress, salt.count,
                    CCPseudoRandomAlgorithm(kCCPRFHmacAlgSHA256), rounds,
                    dk.bindMemory(to: UInt8.self).baseAddress, 32)
            }
        }
    }
    precondition(status == kCCSuccess)
    return derived
}

import org.mindrot.jbcrypt.BCrypt

object PasswordHasher {
    private const val COST = 12 // log2 rounds; 10..12 is the sane band

    fun hash(plain: String): String = BCrypt.hashpw(plain, BCrypt.gensalt(COST))

    fun verify(plain: String, stored: String): Boolean = BCrypt.checkpw(plain, stored)
}

require 'bcrypt'

stored = BCrypt::Password.create(pw, cost: 12)  # $2a$12$<salt+digest>

def valid_password?(stored, pw)
  BCrypt::Password.new(stored) == pw  # == on the Password object, not on strings
end

const std = @import("std");
const c = @cImport(@cInclude("argon2.h")); // build.zig: linkSystemLibrary("argon2")

fn hashPassword(allocator: std.mem.Allocator, password: []const u8) ![]u8 {
    var salt: [16]u8 = undefined;
    std.crypto.random.bytes(&salt);

    const enc_len = c.argon2_encodedlen(2, 19456, 1, salt.len, 32, c.Argon2_id);
    const out = try allocator.alloc(u8, @intCast(enc_len));
    const rc = c.argon2id_hash_encoded(
        2,      // t: iterations
        19456,  // m: KiB of memory (the memory-hard knob)
        1,      // p: parallelism
        password.ptr, password.len,
        &salt, salt.len,
        32,     // hash length
        out.ptr, enc_len);
    if (rc != c.ARGON2_OK) return error.Argon2Failed;
    return out; // $argon2id$v=19$m=19456,t=2,p=1$... — params ride in the string
}

fn verifyPassword(password: []const u8, stored: []const u8) bool {
    return c.argon2id_verify(stored.ptr, password.ptr, password.len) == c.ARGON2_OK;
}