variable

password

Hash and verify passwords using argon2 or bcrypt. The default is argon2. Password hashing functions are necessarily slow, so the asynchronous functions run in a worker thread.

The underlying implementation of these functions is provided by the rust-argon2 and bcrypt Rust crates.

Example with argon2

import {password} from "bun";

const hash = await password.hash("hello world");
const verify = await password.verify("hello world", hash);
console.log(verify); // true

Example with bcrypt

import {password} from "bun";

const hash = await password.hash("hello world", "bcrypt");
// algorithm is optional, will be inferred from the hash if not specified
const verify = await password.verify("hello world", hash, "bcrypt");

console.log(verify); // true

function password.hash(

password: StringOrBuffer,

): Promise<string>;

Asynchronously hash a password using argon2 or bcrypt. The default is argon2.

@param password

The password to hash

If empty, this function throws an error. It is usually a programming mistake to hash an empty password.

@param algorithm

When using bcrypt, passwords longer than 72 bytes are hashed with SHA-512 before being passed to bcrypt

@returns

A promise that resolves to the hashed password

Example with argon2

import {password} from "bun";
const hash = await password.hash("hello world");
console.log(hash); // $argon2id$v=1...
const verify = await password.verify("hello world", hash);

Example with bcrypt

import {password} from "bun";
const hash = await password.hash("hello world", "bcrypt");
console.log(hash); // $2b$10$...
const verify = await password.verify("hello world", hash);

function password.hashSync(

password: StringOrBuffer,

): string;

Synchronously hash a password using argon2 or bcrypt. The default is argon2.

Warning: password hashing is slow. Prefer Bun.password.hash, which runs in a worker thread.

The underlying implementation of these functions is provided by the rust-argon2 and bcrypt Rust crates.

@param password

The password to hash

If empty, this function throws an error. It is usually a programming mistake to hash an empty password.

@param algorithm

When using bcrypt, passwords longer than 72 bytes are hashed with SHA-512 before being passed to bcrypt

Example with argon2

import {password} from "bun";

const hash = await password.hashSync("hello world");
const verify = await password.verifySync("hello world", hash);
console.log(verify); // true

Example with bcrypt

import {password} from "bun";

const hash = await password.hashSync("hello world", "bcrypt");
// algorithm is optional, will be inferred from the hash if not specified
const verify = await password.verifySync("hello world", hash, "bcrypt");

console.log(verify); // true

function password.verify(

password: StringOrBuffer,

hash: StringOrBuffer,

algorithm?: 'argon2d' | 'argon2i' | 'argon2id' | 'bcrypt'

): Promise<boolean>;

Verify a password against a previously hashed password.

@param password

The password to verify.

If empty, always returns false

@param hash

Previously hashed password. If empty, always returns false

@param algorithm

If not specified, the algorithm is inferred from the hash.

If specified and the algorithm does not match the hash, this function throws an error.

@returns

true if the password matches, false otherwise

import {password} from "bun";
await password.verify("hey", "$argon2id$v=19$m=65536,t=2,p=1$ddbcyBcbAcagei7wSkZFiouX6TqnUQHmTyS5mxGCzeM$+3OIaFatZ3n6LtMhUlfWbgJyNp7h8/oIsLK+LzZO+WI");
// true

function password.verifySync(

password: StringOrBuffer,

hash: StringOrBuffer,

algorithm?: 'argon2d' | 'argon2i' | 'argon2id' | 'bcrypt'

): boolean;

Synchronously verify a password against a previously hashed password using argon2 or bcrypt. The default is argon2.

Warning: password hashing is slow. Prefer Bun.password.verify, which runs in a worker thread.

The underlying implementation of these functions is provided by the rust-argon2 and bcrypt Rust crates.

@param password

The password to verify.

@param hash

The hash to verify against.

@param algorithm

If not specified, the algorithm is inferred from the hash.

Example with argon2

import {password} from "bun";

const hash = await password.hashSync("hello world");
const verify = await password.verifySync("hello world", hash);
console.log(verify); // true

Example with bcrypt

import {password} from "bun";

const hash = await password.hashSync("hello world", "bcrypt");
// algorithm is optional, will be inferred from the hash if not specified
const verify = await password.verifySync("hello world", hash, "bcrypt");

console.log(verify); // true