Password Hashing

Regius provides a centralized password hashing utility accessible via App.Hash, supporting bcrypt (default), scrypt, and argon2id. The algorithm and its parameters are configured through environment variables.

Configuration

# Algorithm: bcrypt | scrypt | argon2
HASH_ALGORITHM=bcrypt

# bcrypt cost (4-31, default 12)
HASH_COST=12

# scrypt parameters
HASH_SCRYPT_N=32768
HASH_SCRYPT_R=8
HASH_SCRYPT_P=1

# argon2id parameters
HASH_ARGON2_MEMORY=65536
HASH_ARGON2_ITERATIONS=3
HASH_ARGON2_PARALLELISM=2

Usage

Use it anywhere you have access to the *Regius application instance:

// Hash a password before storing it
hashed, err := h.App.Hash.Generate(plainPassword)

// Verify a password against a stored hash
ok, err := h.App.Hash.Compare(storedHash, plainPassword)

Scaffolding Integration

The make auth scaffolding uses App.Hash directly, so the generated handlers and user model stay hash-agnostic. Defaults preserve the previous behavior (bcrypt at cost 12), so existing password hashes continue to verify.

Supported Algorithms

bcrypt (default)

The default algorithm. Uses golang.org/x/crypto/bcrypt with configurable cost (4-31, default 12).

scrypt

Uses golang.org/x/crypto/scrypt with configurable N, r, and p parameters.

argon2id

Uses golang.org/x/crypto/argon2 with configurable memory, iterations, and parallelism.