pub struct Hash { /* private fields */ }Expand description
Contains the Argon2 hash in PHC format and a stable key identifier.
The hash can be safely stored in your database without special security measures since it’s already cryptographically hashed. However, avoid unnecessary cloning or logging to minimize exposure.
§Fields
-
key_id: A stable, deterministic identifier derived from the API key itself. This ID never changes for the same key, making it perfect for database indexing and key lookups. Format: 32 hex characters (16 bytes of BLAKE3 hash). -
hash: The Argon2id hash in PHC format. This changes each time you hash the same key (due to random salt), but the key_id remains constant.
§PHC Format
The hash is stored in PHC (Password Hashing Competition) format which includes:
- Algorithm identifier (argon2id)
- Version
- Parameters (memory cost, time cost, parallelism)
- Salt (base64-encoded, embedded in the hash string)
- Hash output (base64-encoded)
Example: $argon2id$v=19$m=19456,t=2,p=1$<salt>$<hash>
The salt is embedded within the PHC string and can be extracted if needed using
the password_hash crate’s PasswordHash::new() method.
§Key ID vs Hash
- Key ID: Stable identifier, never changes for the same key
- Hash: Changes each time you hash (due to different random salts)
Both fields can be accessed using the auto-generated getter methods key_id() and hash()
provided by the Getters derive macro.