README
passhash
Easily and securely hash passwords with a variable amount of iterations of SHA512.
Takes in an optional username and number of iterations and then propmts for a password.
If a username or number of iterations is not provided it will prompt for them.
Installation
npm install -g passhash
Usage
-i, --iterations <number> number of SHA512 iterations (default is set to 1)
-b, --bits <number> number of bits to use for crypto random salt, must be >= 128 (default 128)
-h, --help print this message and exit
-u, --username <name> username to use for entry
-U, --updates check for available updates
-f, --format change format of output
-v, --version print the version number and exit
Default Output
username:salt:hash:iterations
test:0V6lfASr44DcJexA0FawChE0ZGo+xM9zBjJMC3S5vp0RH0SdhpS/LIYPI7tP/gms5JVZ2fcnShClgmQif84rdxFQ3A88vZFzIpSBGMSzMabyqPlvzm2BwpS7WLqMbJlXdtSNriQ+PfkKmFj2+oeOS9BNHl2MgSUk8iXu5LB7LXGSinO4k2AsJqB+eslJSL1uzCpA5Ww2weHt47aU+vKWDiuodyPFlL3ahbYAt3nqlkbtr7E0X15nKiEOIWTtdRENCVFyIUf0PLSRYLLZwdnQ5sl414QN8NFcPtDSXEoAblJlcTCa+VJgXx2T2RKdg1RC360GyGsaHtZN9mY8y4Puermp4LWyg1reM9gkXXae63h3pzYjaQc5emSdK+0ljIMKI4aR/wkkLrbnS4/hbeqaE6L1+/X1QPHR0u9BQWAUsUqED6IiStDlSdidn9jBBOAdTIcXPHm6r0fBjoYx2mWmXCdMubF04ojjhsiCY/rcwYZZpjBRYtH8v5H1FWr1QUpzjKETLZml3c3bNAriX9e1GsX8wQqcfDpu/5pKSorfF5qmoIthr5uLsAavfO0XJ9D8C97G3sw91hVazGnvA6ER+PoUx4FZPJYxOFC3dfkOo8CSzOuTgQQaXmlEHJ6TcsVQ6kBMApUaUqqulaxZkZKtZEUu1zlW5CvbIf/kV5z5GtQ=:2a0293e90184f6a9d569a794bd7cc8b46d38e4c4faae54e2f8221463c99ee4ebe46805f629d8189c8c64227833130d5d9f7caea1d9c0a5c5f7e238a0e9f4a149:1444
Change Output Format
passhash
allows the user to define the output. For output to be useful it should include at least the username, the salt, and the hash.
Changing the format is easy. passhash
has built in keywords: {username}
{salt}
{hash}
and {iterations}
. By default they are printed out :
delimited.
For example if you didn't want to output the number of iterations:
node passhash.js -f '{username}<<>>{salt}<<>>{hash}'
This would output:
test<<>>0V6lfASr44DcJexA0FawChE0ZGo+xM9zBjJMC3S5vp0RH0SdhpS/LIYPI7tP/gms5JVZ2fcnShClgmQif84rdxFQ3A88vZFzIpSBGMSzMabyqPlvzm2BwpS7WLqMbJlXdtSNriQ+PfkKmFj2+oeOS9BNHl2MgSUk8iXu5LB7LXGSinO4k2AsJqB+eslJSL1uzCpA5Ww2weHt47aU+vKWDiuodyPFlL3ahbYAt3nqlkbtr7E0X15nKiEOIWTtdRENCVFyIUf0PLSRYLLZwdnQ5sl414QN8NFcPtDSXEoAblJlcTCa+VJgXx2T2RKdg1RC360GyGsaHtZN9mY8y4Puermp4LWyg1reM9gkXXae63h3pzYjaQc5emSdK+0ljIMKI4aR/wkkLrbnS4/hbeqaE6L1+/X1QPHR0u9BQWAUsUqED6IiStDlSdidn9jBBOAdTIcXPHm6r0fBjoYx2mWmXCdMubF04ojjhsiCY/rcwYZZpjBRYtH8v5H1FWr1QUpzjKETLZml3c3bNAriX9e1GsX8wQqcfDpu/5pKSorfF5qmoIthr5uLsAavfO0XJ9D8C97G3sw91hVazGnvA6ER+PoUx4FZPJYxOFC3dfkOo8CSzOuTgQQaXmlEHJ6TcsVQ6kBMApUaUqqulaxZkZKtZEUu1zlW5CvbIf/kV5z5GtQ=<<>>2a0293e90184f6a9d569a794bd7cc8b46d38e4c4faae54e2f8221463c99ee4ebe46805f629d8189c8c64227833130d5d9f7caea1d9c0a5c5f7e238a0e9f4a149
Example Prompt
alex @ [ kovas :: (Darwin) ] ~/Projects/passhash $ node passhash.js
passhash: username: test
passhash: Please enter a password:
passhash: Please re-enter your password:
passhash: Number of iterations (default 1): (1)
undefined:1N1SnR2+aqJPLgtdBZ3Bip4epRzLNAazg/cdqAOIDx65yxiifsf50DE/vXbHFoXtrM2ZbP3N2hq+d20LwkzwLDks//4E726se8iz8cwSgZjnKIYfzGUD6SPtZr7GQuR60TpC7qL9D9tXVHGjz+XS0E1AqaF7sdVna+2FmzQbgLc=:a9901ced04776219b0c59468aba567d16252ad17463ca8d7933206dde70e11b5e914be33d1611dde03e772ddc1dbfd70d5ef6368d9d7e7112ef77d6a539d1d3a:1
Why?
I personally dislike how people do authentication on the web. htpasswd
can easily be broken. passhash
allows for a more robust password storage system.
Now you can store the output of passhash
into a file and code your node server to use it for auth, eliminating the need for htaccess/htpasswd.
For added security you can choose a number of iterations and not store it in the file, using it only in your server code for the password validation.
Each user could also have a different number of iterations. Is this still somewhat insecure? Yes, someone could take a line from the file and
if the user choose a weak password and the attacker knew the number of iterations and the salt they could still use brute force.
You can't protect against stupid users.
License
MIT