# `type.password_hash_exposed`

Password hash is sent, read from a request or put in a failure.

Area 19, [Standard library](../topics/standard-library.md); not declinable; the next step is usually the agent's.

A `PasswordHash` is stored and checked, and never leaves the server: an
`Output`, a request's `Input` and a failure's fields refuse one, however
deep, as `json.write` and `json.read` do. A client that needs to know
whether a password is set is sent that instead.

```jadpo
type StaffName = Text {
    max_length: 100
}

/// What the staff page shows of a member of staff.
type StaffProfile = Output {
    name: StaffName
    hashed_password: PasswordHash
}
```

```text
error: `StaffProfile.hashed_password` holds a password's hash
 --> main.jadpo:8:22
  |
8 |     hashed_password: PasswordHash
  |                      ^^^^^^^^^^^^ sent to a client
  reason: A `PasswordHash` is stored and checked with `crypto.verify_password`, and never leaves the server. A client never needs a password's hash, and anyone who gets one can guess passwords against it offline, at their own pace.
  next: Remove `hashed_password`, and send what the client needs instead, such as whether a password is set (agent)
  rule: type.password_hash_exposed
  help: https://jadpo.dev/docs/errors/type.password_hash_exposed

check failed: 1 error, 1 file
```