Security

Passwords, hashes, tokens, keys and credentials.

Topics

These are the types for what security code keeps and checks: digests, signatures and sealed values, a password policy, passkeys and certificates.

A secret value is a password, key, token or code that your app receives and checks, but never sends, logs, stores or shows.

Type	What it is
`Password`	A password as a person types it: 8 to 256 characters.
`PasswordHash`	A password's hash, ready to store.
`PasswordPolicy`	The rules a password must meet: how short, how long, and whether to check breached lists.
`Hash`	A SHA-256 digest: the 32 bytes `hash.sha256` gives.
`Hmac`	An HMAC-SHA-256 tag, such as a webhook's signature.
`Jwt`	A signed token: three parts joined by `.`.
`JwtClaims`	What a checked token says: who issued it, who it is about and when it expires.
`Jwk`	A public key that a token is checked against, as an identity provider publishes it.
`PublicKey`	An Ed25519 public key: 32 bytes as Base64url.
`Certificate`	An X.509 certificate, the kind that secures a website.
`TotpSecret`	The shared secret behind an authenticator app.
`OneTimeCode`	A code a person types from an app, a text or an email: six to eight digits.
`ApiKey`	A key for an API: up to 512 characters with no spaces.
`SecretText`	Any other secret text, up to 8,192 characters.
`BearerToken`	An access token sent as `Authorization: Bearer`.
`OAuthScope`	One permission an OAuth token grants: `todos:read`.
`OidcClaims`	Who an identity provider says signed in.
`WebAuthnCredential`	A passkey a person registered.
`EncryptedValue`	A value sealed by `crypto.encrypt`.
`PasswordCheck`	What checking a password says: `wrong`, `correct` or `correct_outdated`.

Markdown for agents: /docs/types-security.md.Built from Jadpo main at 6cc3cb4.