Using encoding's standard Marshaler etc interfaces seemed sensible for things that indeed are marshalled and unmarshalled as text and binary, since it makes the result compatible with any use of those interfaces. All well and good, but the client code to use them directly seems clumsy to me as a way to get the base64 encoding to store in a password file. Similarly making the pwdatav3 be visibly required just to verify a typed password against a stored encoding also seems clumsy. Add a minor version that wraps those in two operations that probably will be the only ones people use.