API
#crypto/passwordPassword hashing. Public PBKDF2-HMAC-SHA256 (the primitive that lived only inside the postgres SCRAM path) plus a self-describing encoded hash for login $pbkdf2-sha256$<iterations>$<salt_b64>$<dk_b64> Argon2id is the preferred long-term KDF; it needs a runtime ncall and is not in this package yet. Use a high iteration count until then. XU-CT-USE: fixed-shape-only verify compares digests with crypto/subtle.
pbkdf2_hmac_sha256pub fn pbkdf2_hmac_sha256(password string, salt string, iterations int, key_len int) stringpbkdf2_hmac_sha256 returns `key_len` raw bytes (RFC 2898). Throws on failure.
password stringsalt stringiterations intkey_len intstring — result string
hashpub fn hash(password string) stringhash returns `$pbkdf2-sha256$iter$salt_b64$dk_b64`.
password stringstring — result string
hash_iterpub fn hash_iter(password string, iterations int) stringHash iter. Throws on failure.
password stringiterations intstring — result string
verifypub fn verify(encoded string, password string) boolverify reports whether password matches an encoded hash.
encoded stringpassword stringbool — true or false