node-argon2

Alternatively, you can install the package while ignoring installation scripts and then run the rebuild command manually using node-gyp.

$ npm install argon2 --ignore-scripts
$ npx node-gyp rebuild -C ./node_modules/argon2

If prebuilt binaries are not compatible, you must compile from source. This requires node-gyp installed globally and gcc >= 5 or clang >= 3.3. On OSX, use Homebrew to install GCC, then install node-gyp globally, and finally install argon2 while specifying your compiler binary.

$ brew install gcc
$ npm install -g node-gyp
$ CXX=g++-12 npm install argon2

The module includes built-in TypeScript type declarations. If you are using TypeScript 2.0.0 or later, you can import the library directly without installing additional @types packages.

import * as argon2 from "argon2";

const hash = await argon2.hash(..);

If you want to skip prebuilt binaries and force a compilation from source during the npm install process, use the --build-from-source flag.

$ npm install argon2 --build-from-source

To manually rebuild the binaries, use @mapbox/node-pre-gyp instead of the standard node-gyp because the binding.gyp file relies on specific variables from the @mapbox package.

$ npx @mapbox/node-pre-gyp rebuild -C ./node_modules/argon2

Use argon2.hash(password) to generate a secure hash. By default, it uses Argon2id and provides secure parameters according to Argon2 security recommendations. You can modify parameters like time cost, memory cost, parallelism, hash length, and encoding via options (see project wiki for details).

const argon2 = require("argon2");

try {
  const hash = await argon2.hash("password");
} catch (err) {
  //...
}

Use argon2.verify(hash, password) to check if a plain-text password matches a previously generated PHC string hash. It returns a boolean indicating a match.

try {
  if (await argon2.verify("<big long hash>", "password")) {
    // password match
  } else {
    // password did not match
  }
} catch (err) {
  // internal failure
}

When calling hash(), you can provide a HashOptions object to customize the Argon2 parameters.

Use the verify function to check if a plaintext password matches a previously generated Argon2 encoded digest. It returns a Promise<boolean>.

If the digest was created using a secret, you must provide the same secret in the options object for verification to succeed.

Use the hash function to generate an Argon2 hash from a plaintext password. By default, it returns an encoded string (PHC format). If you pass raw: true in the options, it returns the raw Buffer instead.

If no salt is provided in the options, a 16-byte random salt is automatically generated.

Default Parameters:

• hashLength: 32
• memoryCost: 65536 (1 << 16)
• parallelism: 4
• timeCost: 3
• type: argon2id
• version: 0x13 (19)

The library exports constants representing the three Argon2 variants. You can use these constants in the type field of your HashOptions.

• argon2d: Optimized for resistance against GPU cracking attacks.
• argon2i: Optimized for resistance against side-channel attacks.
• argon2id: A hybrid version that provides a balance of both.