Password

A password as a person types it (NIST SP 800-63B): 8 to 256 characters, none a control character. Taken from an Input, hashed with crypto.hash_password and checked with crypto.verify_password; a secret value, never sent, logged, stored or shown.

Security; not ordered; since Jadpo 0.1.0.

Make one

It comes from outside your code, a secret value that never appears in it.

text.parse(raw, as: Password) reads one from its text; text that isn't one at all fails malformed, such as Tr0ub4d, "tab\there!" or "two\nlines".

Text, JSON and storage

text.parse reads one from its text, as it is typed. Nothing writes it: text.from and text.format don't take it, JSON writes it as "<redacted Password>", and it is never stored.

Shown to people

text.format doesn't take it: a Password is never shown.

Operations

• crypto.hash_password(password: Password) -> PasswordHash: The password's Argon2id hash at the release's parameters (19 MiB, 2 passes, 1 lane), as a PHC string, with a fresh random salt.
• crypto.verify_password(password: Password, hash: PasswordHash) -> PasswordCheck: correct, wrong, or correct_outdated when the hash was made with older parameters and a fresh one should be stored; compared in constant time.

Like every standard type, it also has the contract's own operations: text.parse, json.read, json.write and ==. It isn't ordered, so < and sorting don't take it. Every standard type meets one contract says how they work.