Password

On this page

Shape
Example
Good to know
In JSON
Details

A password as a person types it: 8 to 256 characters.

Use it for what a sign-in form sends. crypto.hash_password makes the PasswordHash you store, and crypto.verify_password checks one. For any other secret, use SecretText.

Shape

One secret value, with no parts.

Example

example

Password("correct horse battery staple")

In a real app it arrives from outside, such as in a request, rather than as text you write in your code.

text.parse(raw, as: Password) reads one from text that comes from outside. Text that isn't one at all fails malformed, such as Tr0ub4d.

Good to know

It is never sent, logged, stored or shown, and text.format won't take it. In JSON it is written redacted.
== tells you whether two are the same. < and list.sort_by don't take it.

In JSON

A string when it arrives, and written redacted when it leaves, in a request, a response or json.write:

json

"<redacted Password>"

Details

Text form, storage, how it is shown, and operations

Password is in the group Security, and has been in Jadpo since 0.1.0.

Text form

text.parse reads one from its text as it is typed. text.from and text.format don't take it, so nothing writes it.

How it is stored

It is never stored.

How it is shown to people

text.format doesn't take it: a Password is never shown.

Operations

crypto.hash_password(password: Password) -> PasswordHash: The password's Argon2id hash at the release's parameters (19 MiB, 2 passes, 1 lane), as a PHC string, with a fresh random salt.
crypto.verify_password(password: Password, hash: PasswordHash) -> PasswordCheck: correct, wrong, or correct_outdated when the hash was made with older parameters and a fresh one should be stored; compared in constant time.

It also takes text.parse, json.read, json.write and ==. How every standard type behaves says how they work.

Markdown for agents: /docs/types/type-password.md.Built from Jadpo main at aee2e8f.