Trait IPasswordHasher 

pub trait IPasswordHasher: Send + Sync {
    // Required methods
    fn hash<'life0, 'life1, 'async_trait>(
        &'life0 self,
        password: &'life1 str,
    ) -> Pin<Box<dyn Future<Output = Result<String, Error>> + Send + 'async_trait>>
       where 'life0: 'async_trait,
             'life1: 'async_trait,
             Self: 'async_trait;
    fn verify<'life0, 'life1, 'life2, 'async_trait>(
        &'life0 self,
        password: &'life1 str,
        stored_hash: &'life2 str,
    ) -> Pin<Box<dyn Future<Output = Result<bool, Error>> + Send + 'async_trait>>
       where 'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait,
             Self: 'async_trait;
    fn needs_rehash(&self, stored_hash: &str) -> bool;
}

Hash and verify passwords (Argon2id by default).

let phc = hasher.hash(&password).await?;             // login / registration
let ok = hasher.verify(&password, &stored.phc).await?; // 401 on false
if ok && hasher.needs_rehash(&stored.phc) {
    stored.phc = hasher.hash(&password).await?;      // transparent upgrade
}

Required Methods

fn hash<'life0, 'life1, 'async_trait>( &'life0 self, password: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<String, Error>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, Self: 'async_trait,

Hash one password with a fresh random salt; returns a PHC string.

The implementation must not panic on any input; failures (including misconfigured parameters) come back as a typed Error.

fn verify<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, password: &'life1 str, stored_hash: &'life2 str, ) -> Pin<Box<dyn Future<Output = Result<bool, Error>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Verify password against a stored PHC hash.

• Ok(true) — the password matches.
• Ok(false) — the password does not match (a client error, not a server error: do not log the stored hash or the password).
• Err(...) — the stored hash is malformed, uses an unsupported algorithm, or the hashing backend failed. This is server-side data or configuration corruption; reporting it as Ok(false) would silently turn a broken account into “wrong password”.

fn needs_rehash(&self, stored_hash: &str) -> bool

Whether a stored hash was produced with weaker/other parameters than the ones this hasher currently uses.

Call after a successful IPasswordHasher::verify and re-hash the password when it returns true — this is how cost parameters are raised without a migration. A hash that cannot be parsed, or that uses a different algorithm, also returns true (it cannot be trusted as-is).

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors

impl IPasswordHasher for Argon2PasswordHasher