# `PasswordHash`

A password's hash, ready to store.

Use it in place of a password on your user's record. `crypto.hash_password` makes one, and `crypto.verify_password` checks a [`Password`](/docs/types/type-password.md) against it. To hash anything else, use [`Hash`](/docs/types/type-hash.md).

## Shape

One value, held as text in one set form, with no parts: `$argon2id$v=19$m=4096,t=3,p=1$AAECAwQFBgcICQoLDA0ODw$VTsSHiMxkq48zEo8LUSymjr7JjaRSgsxGX2Z8HQE9Cw`.

## Example

```jadpo
PasswordHash("$argon2id$v=19$m=19456,t=2,p=1$AAECAwQFBgcICQoLDA0ODw$gYJZtjEAJqjg26xdLmknq8/bB7MiWPrE9hsYuA+SkIU")
```

`PasswordHash(raw)` checks the text, and text that isn't one breaks the `format` rule.

`text.parse(raw, as: PasswordHash)` reads one from text that comes from outside. Text that isn't one at all fails `malformed`, such as `correct horse battery staple`.

This operation gives one: `crypto.hash_password`.

## Good to know

- It holds the Argon2id settings it was made with, so older hashes still check.
- `==` tells you whether two are the same. `<` and `list.sort_by` don't take it.

## In JSON

A string, in a request, a response or `json.write`:

```json
"$argon2id$v=19$m=19456,t=2,p=1$AAECAwQFBgcICQoLDA0ODw$gYJZtjEAJqjg26xdLmknq8/bB7MiWPrE9hsYuA+SkIU"
"$argon2id$v=19$m=4096,t=3,p=1$AAECAwQFBgcICQoLDA0ODw$VTsSHiMxkq48zEo8LUSymjr7JjaRSgsxGX2Z8HQE9Cw"
```

## Details

<details>
<summary>Text form, storage, how it is shown, and operations</summary>

`PasswordHash` is in the group Security, and has been in Jadpo since 0.1.0.

### Text form

`text.from` writes one standard text form, the same form `text.parse` reads back: `$argon2id$v=19$m=19456,t=2,p=1$AAECAwQFBgcICQoLDA0ODw$gYJZtjEAJqjg26xdLmknq8/bB7MiWPrE9hsYuA+SkIU` and `$argon2id$v=19$m=4096,t=3,p=1$AAECAwQFBgcICQoLDA0ODw$VTsSHiMxkq48zEo8LUSymjr7JjaRSgsxGX2Z8HQE9Cw`.

### How it is stored

It is stored in one column named for the field, of type `text`. `$argon2id$v=19$m=4096,t=3,p=1$AAECAwQFBgcICQoLDA0ODw$VTsSHiMxkq48zEo8LUSymjr7JjaRSgsxGX2Z8HQE9Cw` is stored as `'$argon2id$v=19$m=4096,t=3,p=1$AAECAwQFBgcICQoLDA0ODw$VTsSHiMxkq48zEo8LUSymjr7JjaRSgsxGX2Z8HQE9Cw'`.

### How it is shown to people

`text.format(value, locale:)` shows it to people in their locale.

With `locale: Locale.en_gb`:

| Value | Shown |
|---|---|
| `$argon2id$v=19$m=19456,t=2,p=1$AAECAwQFBgcICQoLDA0ODw$gYJZtjEAJqjg26xdLmknq8/bB7MiWPrE9hsYuA+SkIU` | `$argon2id$v=19$m=19456,t=2,p=1$AAECAwQFBgcICQoLDA0ODw$gYJZtjEAJqjg26xdLmknq8/bB7MiWPrE9hsYuA+SkIU` |
| `$argon2id$v=19$m=4096,t=3,p=1$AAECAwQFBgcICQoLDA0ODw$VTsSHiMxkq48zEo8LUSymjr7JjaRSgsxGX2Z8HQE9Cw` | `$argon2id$v=19$m=4096,t=3,p=1$AAECAwQFBgcICQoLDA0ODw$VTsSHiMxkq48zEo8LUSymjr7JjaRSgsxGX2Z8HQE9Cw` |

### Operations

- `crypto.hash_password(password: Password) -> PasswordHash`: The password's Argon2id hash at the release's parameters (19 MiB, 2 passes, 1 lane), as a PHC string, with a fresh random salt.
- `crypto.verify_password(password: Password, hash: PasswordHash) -> PasswordCheck`: `correct`, `wrong`, or `correct_outdated` when the hash was made with older parameters and a fresh one should be stored; compared in constant time.

It also takes `text.parse`, `text.from`, `text.format`, `json.read`, `json.write` and `==`. [How every standard type behaves](/docs/every-standard-type-meets-one-contract.md) says how they work.

</details>