Bcrypt

These libraries are experimental. APIs may change without notice. Generated from source with koruc 0.1.7 on 11/4/2026.

@korulang/bcrypt@0.0.1

bcrypt password hashing for Koru — $2a$/$2b$ modular-crypt digests, Rails has_secure_password compatible

bcrypt/index.kz · 2 tors

@korulang/bcrypt — bcrypt password hashing for Koru · 15 more lines

@korulang/bcrypt — bcrypt password hashing for Koru A thin lift over Zig std.crypto.pwhash.bcrypt's modular-crypt hasher — the `$2a$`/`$2b$...` digest Rails `has_secure_password` (bcrypt-ruby) writes and `BCrypt::Password.new(digest).is_password?(pw)` reads back. No C library, no vendored code: the stdlib already carries a bcrypt verified against the OpenBSD test vectors, so this package only adapts the surface. import libs/bcrypt libs/bcrypt:hash(password: "secret123456", cost: 12): digest |> ... libs/bcrypt:verify(password: "secret123456", digest: digest): ok |> ... `silently_truncate_password = true` on both paths matches bcrypt-ruby exactly: only the first 72 password bytes feed the cipher (the alternative — HMAC-SHA512 pre-hashing — would produce digests no other bcrypt accepts).

verify

index.kz:25

// verify — the read path. A malformed digest is a `false`, not an error:
// bcrypt-ruby's is_password? rescues every parse failure the same way, so a
// garbage string in the database means "not this password", never a crash.
~pub tor verify { password: ?string, digest: string } -> bool

hash

index.kz:58

// hash — the write path. Emits a fresh `$2b$` modular-crypt digest (random
// 16-byte salt) at 2^cost work. `cost` is bcrypt-ruby's accepted range,
// 4 (its MIN_COST, used by Rails in test env) through 31; outside that the
// call is a programming error and asserts loudly — there is no silent clamp.
~pub tor hash { password: string, cost: i32 } -> string