# @jongleberry/passwords

> Password creation and validation

Latest version **1.2.2** (published 2020-05-05) · MIT license · 0 weekly downloads

## Install

```sh
npm install @jongleberry/passwords
pnpm add @jongleberry/passwords
yarn add @jongleberry/passwords
bun add @jongleberry/passwords
```

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 1.2.2 |
| Published | 2020-05-05 |
| First published | 2020-04-18 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 2 |
| Unpacked size | 8.5 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 4 |
| Author | Jonathan Ong |
| Maintainers | jongleberry |
| Keywords | passwords, hibp, haveibeenpwned, scrypt |

## Links

- npm: https://www.npmjs.com/package/@jongleberry/passwords
- Repository: https://github.com/jonathanong/passwords
- Homepage: https://github.com/jonathanong/passwords#readme
- Issues: https://github.com/jonathanong/passwords/issues
- npm.io page: https://npm.io/package/@jongleberry/passwords

## Dependencies (2)

- [http-assert](https://npm.io/package/http-assert.md) ^1.4.1
- [find-cache-dir](https://npm.io/package/find-cache-dir.md) ^3.3.1

## Recent versions

- 1.2.2 (latest) — 2020-05-05
- 1.2.1 — 2020-05-02
- 1.2.0 — 2020-05-01
- 1.1.2 — 2020-04-23
- 1.1.1 — 2020-04-23
- 1.1.0 — 2020-04-21
- 1.0.0 — 2020-04-18

## README

# Passwords

[![Node.js CI](https://github.com/jonathanong/passwords/workflows/Node.js%20CI/badge.svg?branch=master)](https://github.com/jonathanong/passwords/actions?query=workflow%3A%22Node.js+CI%22+branch%3Amaster)
[![codecov](https://codecov.io/gh/jonathanong/passwords/branch/master/graph/badge.svg?token=4me2xcwg7f)](https://codecov.io/gh/jonathanong/passwords)

Personal library for managing passwords.

Features:

- Hash and verify passwords with node.js-native scrypt
- Checks passwords against the [haveibeenpwned](https://haveibeenpwned.com/API/v3#PwnedPasswords) database and disallow pwned passwords
  - Provides a configurable timeout for hitting HIBP
  - Does not handle HIBP retries. Because its APIs are served by CloudFlare, retries are probably unnecessary.
- Configurable minimum password length with a default of 8 characters
- HTTP client-friendly errors with [http-errors](https://www.npmjs.com/package/http-errors)

## API

```js
const Passwords = require('@jongleberry/passwords')

const passwords = new Passwords({
  // options
})

const [key, salt] = await passwords.createPassword('some password')

const isValidPassword = await passwords.comparePassword('some password', key, salt)
```

### Options

- `hibpTimeout = 1000` - timeout to [hibp](https://haveibeenpwned.com/API/v3#PwnedPasswords) in milliseconds. If for some reason hibp takes longer than this timeout, the password will be assumed to be valid.
- `minimumPasswordLength = 8` - minimum password character length
- `saltLength = 16` - salt length in bytes
- `keyLength = 64` - derived key length in bytes
- `scryptOptions = {}` - options passed directly to [scrypt](https://nodejs.org/api/crypto.html#crypto_crypto_scrypt_password_salt_keylen_options_callback)

NOTE: changing `scryptOptions` will change the derived key, so keep it consistent in your app or store it along with your password.

### [key, salt, scryptOptions] = await createPassword(password)

Create a derived key and salt from a password.

### isValidPassword = await comparePassword(password, key, salt [, scryptOptions])

Validate the password with the derived key and salt. `scryptOptions` is only necessary if it's different than the currently set options.

---
_Source: https://npm.io/package/@jongleberry/passwords · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._