Install & Compatibility
Where this runs
No compatibility data collected yet for this library.
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
default (SecurePassword)
✓ import SecurePassword from 'secure-password'
✗ const SecurePassword = require('secure-password')
ESM import since v4. CommonJS require works but is not recommended for new code.
SecurePassword (named)
✓ import { SecurePassword } from 'secure-password'
✗ import securePassword from 'secure-password'
Named export available for explicit imports.
constants (MEMLIMIT_DEFAULT, etc.)
✓ import { MEMLIMIT_DEFAULT, MEMLIMIT_MIN, MEMLIMIT_MAX, OPSLIMIT_DEFAULT, OPSLIMIT_MIN, OPSLIMIT_MAX, INVALID, INVALID_UNRECOGNIZED_HASH, VALID, VALID_NEEDS_REHASH } from 'secure-password'
✗ SecurePassword.MEMLIMIT_DEFAULT (after construction)
Constants are exported as named exports; accessing via instance works but less clean.
SecurePassword type (TypeScript)
✓ import type { SecurePassword } from 'secure-password'
✗ import SecurePassword from 'secure-password'
Type-only import for type annotations.
Hashes and verifies a password using Argon2id with automatic rehashing detection.
import SecurePassword from 'secure-password';
const pwd = new SecurePassword();
const password = Buffer.from('my secret password');
// Hash
const hash = await pwd.hash(password);
// Verify
const result = await pwd.verify(password, hash);
switch (result) {
case SecurePassword.INVALID_UNRECOGNIZED_HASH:
console.error('Hash not made with secure-password. Try legacy.');
break;
case SecurePassword.INVALID:
console.log('Invalid password');
break;
case SecurePassword.VALID:
console.log('Authenticated');
break;
case SecurePassword.VALID_NEEDS_REHASH:
console.log('Authenticated; hash needs upgrade.');
const improvedHash = await pwd.hash(password);
// save improvedHash
break;
}
Errors
Common errors & fixes
TypeError: Cannot read property 'hash' of undefined
CommonJS require() returns undefined because ESM-only package.
fixChange to import SecurePassword from 'secure-password' (ESM).
Error: sodium-native is not installed
Missing sodium-native dependency; often due to incomplete npm install or platform incompatibility.
fixRun 'npm install' and ensure your platform supports sodium-native (requires libsodium). For Alpine Linux, install libsodium-dev.
AssertionError [ERR_ASSERTION]: password must be a Buffer
Passed a string when Buffer is required.
fixWrap password with Buffer.from(password).
TypeError: securePassword is not a constructor
Using new with a wrong import style (e.g., import securePassword from 'secure-password' without default export).
fixUse correct import: import SecurePassword from 'secure-password' or const SecurePassword = require('secure-password').default (for CJS). Error: Unknown hash: ...
Hash format not recognized; usually from another password library.
fixEnsure hash was produced by secure-password or implement fallback verification.
Audit
Dependencies
sodium-nativerequiredArgon2id implementation via libsodium bindings