#[non_exhaustive]pub struct Hash { /* private fields */ }Expand description
Implementations§
Source§impl Hash
impl Hash
Sourcepub fn new_argon2id(password: &str, salt: Salt) -> Result<Self>
pub fn new_argon2id(password: &str, salt: Salt) -> Result<Self>
Creates a new Hash using Argon2id — the recommended variant.
§Errors
Returns Error::Decode if salt is not valid UTF-8, or
Error::Hashing if the underlying argon2 crate rejects the
parameters (output buffer too small, salt too short, etc.).
§Examples
use hsh::models::hash::{Hash, Salt};
let salt: Salt = b"abcdefghijklmnop".to_vec();
let h = Hash::new_argon2id("correct horse battery staple", salt)?;
assert!(!h.hash().is_empty());Sourcepub fn new_argon2i(password: &str, salt: Salt) -> Result<Self>
👎Deprecated since 0.0.9: Argon2i is verify-only — use Hash::new_argon2id for new hashes.
pub fn new_argon2i(password: &str, salt: Salt) -> Result<Self>
Argon2i is verify-only — use Hash::new_argon2id for new hashes.
Creates a new Hash using Argon2i.
Verify-only for legacy hashes — Argon2i is not recommended for
new password hashes. Prefer Hash::new_argon2id.
Available only with the compat-v0_0_x feature. Slated for
removal in v0.2.0 per the API stability contract.
Sourcepub fn new_bcrypt(password: &str, cost: u32) -> Result<Self>
pub fn new_bcrypt(password: &str, cost: u32) -> Result<Self>
Creates a new Hash using Bcrypt at the given cost.
§Errors
Returns Error::InvalidPassword if the password exceeds 72
bytes (the bcrypt input limit — CVE-2025-22228 class) and the
safety rail is engaged. Use
crate::algorithms::bcrypt::BcryptParams::with_prehash for
explicit handling of longer inputs. Returns Error::Hashing
if the underlying bcrypt crate reports a primitive failure.
Sourcepub fn new_scrypt(password: &str, salt: Salt) -> Result<Self>
pub fn new_scrypt(password: &str, salt: Salt) -> Result<Self>
Creates a new Hash using Scrypt with OWASP-2025 default params.
§Errors
Returns Error::Decode if salt is not valid UTF-8, or
Error::Hashing if the underlying scrypt crate rejects the
parameter set (output buffer too small, N not a power of two,
etc.).
Sourcepub fn algorithm(&self) -> HashAlgorithm
pub fn algorithm(&self) -> HashAlgorithm
Returns the hashing algorithm used by this hash.
Sourcepub fn from_hash(hash: &[u8], algo: &str) -> Result<Self>
pub fn from_hash(hash: &[u8], algo: &str) -> Result<Self>
Builds a Hash from existing hash bytes and an algorithm tag.
§Errors
Returns Error::UnsupportedAlgorithm if algo is not one of
the recognised tags (argon2id, argon2i, argon2d, bcrypt,
scrypt, pbkdf2, pbkdf2-sha256, pbkdf2-sha512).
Sourcepub fn from_string(hash_str: &str) -> Result<Self>
pub fn from_string(hash_str: &str) -> Result<Self>
Parses the legacy $algo$...$hash serialized form.
Not PHC-compliant — kept for backwards compatibility with
pre-0.0.9 stored hashes. New code should round-trip through
crate::api::hash / crate::api::verify_and_upgrade which
emit RustCrypto-compatible PHC strings.
§Errors
Returns Error::InvalidHashString if the string doesn’t have
the expected six $-separated fields,
Error::UnsupportedAlgorithm if the algorithm tag isn’t
recognised, or Error::Decode if the trailing base64 hash
field is malformed.
Sourcepub fn generate_hash(password: &str, salt: &str, algo: &str) -> Result<Vec<u8>>
pub fn generate_hash(password: &str, salt: &str, algo: &str) -> Result<Vec<u8>>
Generates a raw hash for password with the given salt and
algorithm tag. Returns the raw bytes only; for the storable
form build a Hash and call Hash::to_string_representation,
or use crate::api::hash for the modern PHC-formatted output.
§Errors
Returns Error::UnsupportedAlgorithm for an unrecognised tag,
or any Error variant the underlying primitive emits — see
the per-algorithm hash_with documentation in
crate::algorithms.
Sourcepub fn generate_random_string(len: usize) -> Result<String>
pub fn generate_random_string(len: usize) -> Result<String>
Generates a random alphanumeric string of length len from the
OS CSPRNG (getrandom::getrandom). Suitable for human-readable
Argon2 salts.
§Errors
Returns Error::Hashing if getrandom::getrandom fails —
in practice this only happens when the OS entropy source isn’t
available (very early boot, hardened sandbox without
/dev/urandom).
Sourcepub fn generate_salt(algo: &str) -> Result<String>
pub fn generate_salt(algo: &str) -> Result<String>
Generates a salt suitable for the named algorithm using the OS CSPRNG. Returns a UTF-8 string ready for storage.
§Errors
Returns Error::UnsupportedAlgorithm if algo isn’t one of
"argon2id", "argon2i", "argon2d", "bcrypt", or
"scrypt"; Error::Hashing if the OS CSPRNG fails.
Sourcepub fn hash_length(&self) -> usize
pub fn hash_length(&self) -> usize
Returns the length of the hash bytes.
Sourcepub fn new(password: &str, salt: &str, algo: &str) -> Result<Self>
pub fn new(password: &str, salt: &str, algo: &str) -> Result<Self>
Builds a Hash from a password, salt, and algorithm tag.
Recognised tags: "argon2id" (recommended), "argon2i",
"argon2d", "bcrypt", "scrypt", "pbkdf2",
"pbkdf2-sha256", "pbkdf2-sha512".
§Errors
Returns Error::InvalidPassword if password.len() < 8,
Error::UnsupportedAlgorithm for an unknown tag, or any
Error variant the underlying primitive emits.
Sourcepub fn parse(input: &str) -> Result<Self>
pub fn parse(input: &str) -> Result<Self>
Parses a JSON string into a Hash.
§Errors
Returns Error::Decode wrapping a serde_json::Error if the
input isn’t a valid serialised Hash.
Sourcepub fn parse_algorithm(hash_str: &str) -> Result<HashAlgorithm>
pub fn parse_algorithm(hash_str: &str) -> Result<HashAlgorithm>
Extracts the algorithm marker from a legacy serialized hash string.
§Errors
Returns Error::InvalidHashString if there’s no $-delimited
algorithm field, or Error::UnsupportedAlgorithm if the field
is present but unrecognised.
Sourcepub fn set_hash(&mut self, hash: &[u8])
pub fn set_hash(&mut self, hash: &[u8])
Sets the hash bytes, zeroing the previous buffer first.
Sourcepub fn set_password(
&mut self,
password: &str,
salt: &str,
algo: &str,
) -> Result<()>
pub fn set_password( &mut self, password: &str, salt: &str, algo: &str, ) -> Result<()>
Re-hashes password with salt under algo and replaces the
stored hash. The previous buffer is zeroized before replacement.
§Errors
Returns any Error variant that Self::generate_hash may
emit (UnsupportedAlgorithm for an unknown tag, or any
primitive-level failure from the underlying KDF).
Sourcepub fn set_salt(&mut self, salt: &[u8])
pub fn set_salt(&mut self, salt: &[u8])
Sets the salt bytes, zeroing the previous buffer first.
Sourcepub fn to_string_representation(&self) -> String
pub fn to_string_representation(&self) -> String
Returns a non-PHC salt:hex debug string.
Sourcepub fn verify(&self, password: &str) -> Result<bool>
pub fn verify(&self, password: &str) -> Result<bool>
Verifies password against this hash.
Constant-time: the byte comparison uses
subtle::ConstantTimeEq. The bcrypt path delegates to the
bcrypt crate, which also uses subtle internally.
Returns Ok(true) for a match, Ok(false) for a mismatch, or an
Error if the stored material is malformed.