Registry / security / secure-password

secure-password

JSON →
library4.0.0jsnpmunverified

Password hashing library using Argon2id via libsodium. Current stable version is 4.0.0, with maintenance releases on GitHub. It provides safe defaults, future-proof work factor upgrades, and uses Buffers for memory safety. Differentiates from bcrypt and scrypt by using the modern Argon2id algorithm and offering explicit rehashing guidance (VALID_NEEDS_REHASH).

npm install secure-password
INSTALL
IMPORT
SIG · SECURE-PASSWORD
S
secure-password
securityjavascriptv4.0.0
harness data pending
Install & Compatibility
Where this runs

No compatibility data collected yet for this library.

Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

default (SecurePassword)
import SecurePassword from 'secure-password'
const SecurePassword = require('secure-password')
ESM import since v4. CommonJS require works but is not recommended for new code.
SecurePassword (named)
import { SecurePassword } from 'secure-password'
import securePassword from 'secure-password'
Named export available for explicit imports.
constants (MEMLIMIT_DEFAULT, etc.)
import { MEMLIMIT_DEFAULT, MEMLIMIT_MIN, MEMLIMIT_MAX, OPSLIMIT_DEFAULT, OPSLIMIT_MIN, OPSLIMIT_MAX, INVALID, INVALID_UNRECOGNIZED_HASH, VALID, VALID_NEEDS_REHASH } from 'secure-password'
SecurePassword.MEMLIMIT_DEFAULT (after construction)
Constants are exported as named exports; accessing via instance works but less clean.
SecurePassword type (TypeScript)
import type { SecurePassword } from 'secure-password'
import SecurePassword from 'secure-password'
Type-only import for type annotations.

Hashes and verifies a password using Argon2id with automatic rehashing detection.

import SecurePassword from 'secure-password'; const pwd = new SecurePassword(); const password = Buffer.from('my secret password'); // Hash const hash = await pwd.hash(password); // Verify const result = await pwd.verify(password, hash); switch (result) { case SecurePassword.INVALID_UNRECOGNIZED_HASH: console.error('Hash not made with secure-password. Try legacy.'); break; case SecurePassword.INVALID: console.log('Invalid password'); break; case SecurePassword.VALID: console.log('Authenticated'); break; case SecurePassword.VALID_NEEDS_REHASH: console.log('Authenticated; hash needs upgrade.'); const improvedHash = await pwd.hash(password); // save improvedHash break; }
Debug
Known issues
breakingVersion 4 drops CommonJS support; only ESM imports are allowed.
fix
Use import syntax instead of require(). For TypeScript, ensure 'esModuleInterop' is true if using default import.
affects: >=4.0.0
breakingVersion 4 replaces sodium with sodium-native, changing all crypto operations.
fix
Update from sodium-based to sodium-native; verify any custom sodium usage in your code.
affects: >=4.0.0
gotchaPasswords must be Buffers; passing strings will throw or produce incorrect hashes.
fix
Convert strings to Buffer via Buffer.from(password) before calling hash or verify.
affects: >=1.0.0
deprecatedThe callback-based API (pwd.hash(userPassword, cb)) is deprecated in favor of Promise-based async/await.
fix
Use async/await syntax (e.g., const hash = await pwd.hash(password)).
affects: >=4.0.0
gotchaThe MEMLIMIT and OPSLIMIT constants are exported directly, not as properties of the class. Accessing via instance (e.g., pwd.MEMLIMIT_DEFAULT) works but may be misleading.
fix
Import the constants directly: import { MEMLIMIT_DEFAULT } from 'secure-password'.
affects: >=4.0.0
Errors
Common errors & fixes
TypeError: Cannot read property 'hash' of undefined
CommonJS require() returns undefined because ESM-only package.
fix
Change to import SecurePassword from 'secure-password' (ESM).
Error: sodium-native is not installed
Missing sodium-native dependency; often due to incomplete npm install or platform incompatibility.
fix
Run 'npm install' and ensure your platform supports sodium-native (requires libsodium). For Alpine Linux, install libsodium-dev.
AssertionError [ERR_ASSERTION]: password must be a Buffer
Passed a string when Buffer is required.
fix
Wrap password with Buffer.from(password).
TypeError: securePassword is not a constructor
Using new with a wrong import style (e.g., import securePassword from 'secure-password' without default export).
fix
Use correct import: import SecurePassword from 'secure-password' or const SecurePassword = require('secure-password').default (for CJS).
Error: Unknown hash: ...
Hash format not recognized; usually from another password library.
fix
Ensure hash was produced by secure-password or implement fallback verification.
Upgrade
Version history
4.0.0latest on npm
Audit
Dependencies
sodium-nativerequiredArgon2id implementation via libsodium bindings
Agent activity
23 hits · last 30 days
node
18
Amazon
1
OpenAI (training)
1
Resources
secure-password — npm install secure-password · libregistry