Bindings to the reference Argon2 implementation.
Want to use it on command line? Instead check node-argon2-cli.
It's possible to hash using either Argon2i (default), Argon2d and Argon2id, and verify if a password matches a hash.
To hash a password:
const argon2 = require('argon2');
try {
const hash = await argon2.hash("password");
} catch (err) {
//...
}
To see how you can modify the output (hash length, encoding) and parameters (time cost, memory cost and parallelism), read the wiki
To verify a password:
try {
if (await argon2.verify("<big long hash>", "password")) {
// password match
} else {
// password did not match
}
} catch (err) {
// internal failure
}
A TypeScript type declaration file is published with this module. If you are using TypeScript >= 2.0.0 that means you do not need to install any additional typings in order to get access to the strongly typed interface. Simply use the library as mentioned above. This library uses Promises, so make sure you are targeting ES6+, including the es2015.promise lib in your build, or globally importing a Promise typings library.
Some example tsconfig.json compiler options:
{
"compilerOptions": {
"lib": ["es2015.promise"]
}
}
or
{
"compilerOptions": {
"target": "es6"
}
}
import * as argon2 from "argon2";
const hash = await argon2.hash(..);
Differences from node-argon2-ffi
This library is implemented natively, meaning it is an extension to the node engine. Thus, half of the code are C++ bindings, the other half are Javascript functions. node-argon2-ffi uses ffi, a mechanism to call functions from one language in another, and handles the type bindings (e.g. JS Number -> C++ int).
The interface of both are very similar, notably node-argon2-ffi splits the
argon2i and argon2d function set, but this module also has the argon2id option.
Also, while node-argon2-ffi suggests you promisify crypto.randomBytes
, this
library does that internally.
Performance-wise, the libraries are equal. You can run the same benchmark suite if you are curious, but both can perform around 130 hashes/second on an Intel Core i5-4460 @ 3.2GHz with default options.
node-argon2 provides prebuilt binaries from v0.26.0
onwards. They are
built per release using GitHub Actions.
The current prebuilt binaries are built (and tested) with the following matrix:
- Node 10.x, 12.x, 13.x
- Ubuntu 16.04, Windows Server 2019, macOS Catalina 10.15
If your plaform is below the above requirements, you can follow the Before Installing section below to manually compile from source. It is also always recommended to build from source to ensure consistency of the compiled module.
You can skip this section if the prebuilt binaries work for you.
You MUST have a node-gyp global install before proceeding with install, along with GCC >= 5 / Clang >= 3.3. On Windows, you must compile under Visual Studio 2015 or newer.
node-argon2 works only and is tested against Node >=10.0.0.
To install GCC >= 5 on OSX, use homebrew:
$ brew install gcc
Once you've got GCC installed and ready to run, you then need to install node-gyp, you must do this globally:
$ npm install -g node-gyp
Finally, once node-gyp is installed and ready to go, you can install this library, specifying the GCC or Clang binary to use:
$ CXX=g++-6 npm install argon2
NOTE: If your GCC or Clang binary is named something different than g++-6
,
you'll need to specify that in the command.
How do I manually rebuild the binaries?
$ npx node-pre-gyp rebuild -C ./node_modules/argon2
Run
node-pre-gyp
instead ofnode-gyp
because node-argon2'sbinding.gyp
file relies on variables fromnode-pre-gyp
.
You can omit
npx
if you have a global installation ofnode-pre-gyp
, otherwise prefixingnpx
will use the local one in./node_modules/.bin
How do I skip installing prebuilt binaries and manually compile from source?
You can do either of the two methods below:
- Force build from source on install.
$ npm install argon2 --build-from-source
- Ignore
node-argon2
install script and build manually.
$ npm install argon2 --ignore-scripts
$ npx node-pre-gyp rebuild -C ./node_modules/argon2
Work licensed under the MIT License. Please check P-H-C/phc-winner-argon2 for license over Argon2 and the reference implementation.