# Security

Passwords, hashes, tokens, keys and credentials.

## Topics

| Page | What it covers |
|---|---|
| [Security records](/docs/security-records.md) | These are the types for what security code keeps and checks: digests, signatures and sealed values, a password policy, passkeys and certificates. |
| [Secret values](/docs/secret-values.md) | A secret value is a password, key, token or code that your app receives and checks, but never sends, logs, stores or shows. |

## Types

| Type | What it is |
|---|---|
| [`Password`](/docs/types/type-password.md) | A password as a person types it: 8 to 256 characters. |
| [`PasswordHash`](/docs/types/type-password-hash.md) | A password's hash, ready to store. |
| [`PasswordPolicy`](/docs/types/type-password-policy.md) | The rules a password must meet: how short, how long, and whether to check breached lists. |
| [`Hash`](/docs/types/type-hash.md) | A SHA-256 digest: the 32 bytes `hash.sha256` gives. |
| [`Hmac`](/docs/types/type-hmac.md) | An HMAC-SHA-256 tag, such as a webhook's signature. |
| [`Jwt`](/docs/types/type-jwt.md) | A signed token: three parts joined by `.`. |
| [`JwtClaims`](/docs/types/type-jwt-claims.md) | What a checked token says: who issued it, who it is about and when it expires. |
| [`Jwk`](/docs/types/type-jwk.md) | A public key that a token is checked against, as an identity provider publishes it. |
| [`PublicKey`](/docs/types/type-public-key.md) | An Ed25519 public key: 32 bytes as Base64url. |
| [`Certificate`](/docs/types/type-certificate.md) | An X.509 certificate, the kind that secures a website. |
| [`TotpSecret`](/docs/types/type-totp-secret.md) | The shared secret behind an authenticator app. |
| [`OneTimeCode`](/docs/types/type-one-time-code.md) | A code a person types from an app, a text or an email: six to eight digits. |
| [`ApiKey`](/docs/types/type-api-key.md) | A key for an API: up to 512 characters with no spaces. |
| [`SecretText`](/docs/types/type-secret-text.md) | Any other secret text, up to 8,192 characters. |
| [`BearerToken`](/docs/types/type-bearer-token.md) | An access token sent as `Authorization: Bearer`. |
| [`OAuthScope`](/docs/types/type-o-auth-scope.md) | One permission an OAuth token grants: `todos:read`. |
| [`OidcClaims`](/docs/types/type-oidc-claims.md) | Who an identity provider says signed in. |
| [`WebAuthnCredential`](/docs/types/type-web-authn-credential.md) | A passkey a person registered. |
| [`EncryptedValue`](/docs/types/type-encrypted-value.md) | A value sealed by `crypto.encrypt`. |
| [`PasswordCheck`](/docs/types/type-password-check.md) | What checking a password says: `wrong`, `correct` or `correct_outdated`. |