# `Password`

A password as a person types it: 8 to 256 characters.

Use it for what a sign-in form sends. `crypto.hash_password` makes the [`PasswordHash`](/docs/types/type-password-hash.md) you store, and `crypto.verify_password` checks one. For any other secret, use [`SecretText`](/docs/types/type-secret-text.md).

## Shape

One secret value, with no parts.

## Example

```jadpo
Password("correct horse battery staple")
```

In a real app it arrives from outside, such as in a request, rather than as text you write in your code.

`text.parse(raw, as: Password)` reads one from text that comes from outside. Text that isn't one at all fails `malformed`, such as `Tr0ub4d`.

## Good to know

- It is never sent, logged, stored or shown, and `text.format` won't take it. In JSON it is written redacted.
- `==` tells you whether two are the same. `<` and `list.sort_by` don't take it.

## In JSON

A string when it arrives, and written redacted when it leaves, in a request, a response or `json.write`:

```json
"<redacted Password>"
```

## Details

<details>
<summary>Text form, storage, how it is shown, and operations</summary>

`Password` is in the group Security, and has been in Jadpo since 0.1.0.

### Text form

`text.parse` reads one from its text as it is typed. `text.from` and `text.format` don't take it, so nothing writes it.

### How it is stored

It is never stored.

### How it is shown to people

`text.format` doesn't take it: a `Password` is never shown.

### Operations

- `crypto.hash_password(password: Password) -> PasswordHash`: The password's Argon2id hash at the release's parameters (19 MiB, 2 passes, 1 lane), as a PHC string, with a fresh random salt.
- `crypto.verify_password(password: Password, hash: PasswordHash) -> PasswordCheck`: `correct`, `wrong`, or `correct_outdated` when the hash was made with older parameters and a fresh one should be stored; compared in constant time.

It also takes `text.parse`, `json.read`, `json.write` and `==`. [How every standard type behaves](/docs/every-standard-type-meets-one-contract.md) says how they work.

</details>