Secure random salt
A unique cryptographically secure salt is generated for each new password hash.
Data protection · REST API
Password Hashing API: BCrypt and Argon2id
Generate secure password hashes with an automatically generated salt, then verify passwords against stored hashes.
Free tier available. Both endpoints require a JWT Bearer Token.
Key features
Adaptive algorithms
Choose BCrypt or memory-hard Argon2id; secure parameters are managed server-side.
Automatic verification
The verification endpoint detects the algorithm from the complete stored hash.
Generate a secure password hash
Submit the password and the chosen algorithm. The response contains the algorithm and a complete hash with its salt and parameters.
Endpoint
POST
/api/v1/data-protection/password/hash
Request: application/json · Response: application/json
Request example
{
"password": "MySecretPassword123!",
"algorithm": "ARGON2ID"
}
Response example
{
"algorithm": "ARGON2ID",
"hash": "$argon2id$v=19$m=65536,t=3,p=1$UPGxYeX1kAufNDUn2vE2ew$+UV+F3Mv/iut8Ojt27mQy6gBl0CgjNSrlIyqHkGqrug"
}
Store the entire returned hash, not the plaintext password. Repeated requests can generate different hashes for the same password because each uses a new random salt.
Explore password hashing in SwaggerVerify a password against a hash
Provide the password and the complete stored BCrypt or Argon2id hash. The algorithm is detected automatically; a non-matching password returns valid=false, not a request error.
Endpoint
POST
/api/v1/data-protection/password/verify
Request: application/json · Response: application/json
Request example
{
"password": "MySecretPassword123!",
"hash": "$2a$10$s8zjATmilgpbSmHj/PEKB.qDir/WNo6XXwYQJaOfOk/DrBnpr3XLy"
}
Response example
{
"valid": true
}
Pass the hash exactly as stored, including salt and algorithm parameters. Unsupported formats or parameters beyond the accepted security limits are rejected as invalid requests.
Explore password verification in SwaggerSupported algorithms and parameters
| Algorithm | Generation parameters | Accepted verification parameters |
|---|---|---|
| BCRYPT | Cost factor 10 | Cost factor 4–10 |
| ARGON2ID | Memory 65536 KiB; iterations 3; parallelism 1 | Memory up to 65536 KiB; iterations up to 3; parallelism up to 1 |
Argon2id is recommended for new applications when supported. BCrypt remains useful for compatibility with existing systems.
Use cases
- Hash passwords before storing them in an application database.
- Verify submitted passwords during user authentication.
- Support BCrypt and Argon2id integration workflows.
Security considerations
Passwords are processed exactly as provided, without trimming or sanitization. Do not store plaintext passwords. Protect requests using HTTPS and keep the complete hash for verification. Password hashing is one-way; it is not reversible encryption.
Explore more DevHub APIs
