A Go library providing a convenient wrapper for secure password hashing using the scrypt key derivation function.
simple-scrypt is a Go library that provides a convenient wrapper around Go's scrypt package for secure password hashing. It simplifies generating and comparing password hashes using the scrypt key derivation function with secure defaults and parameter management. The library addresses the need for strong, future-proof password storage in Go applications.
Go developers building applications that require secure user authentication and password storage. Particularly useful for those migrating from bcrypt or implementing scrypt-based authentication for the first time.
Developers choose simple-scrypt because it provides a clean, bcrypt-like API for scrypt operations with secure defaults out of the box. Its unique ability to upgrade hash parameters over time ensures password security can evolve with hardware improvements without breaking existing authentication systems.
A convenience library for generating, comparing and inspecting password hashes using the scrypt KDF in Go 🔑
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses N=16384, r=8, p=1 with cryptographically secure salts generated automatically, providing strong security out of the box without configuration.
Allows upgrading scrypt parameters over time without invalidating existing hashes, with parameters stored alongside derived keys for easy migration as hardware improves.
Mirrors Go's bcrypt library API closely, making adoption and migration from bcrypt-based systems straightforward for developers.
Can determine optimal scrypt parameters based on desired time and memory constraints, though calibration is expensive and recommended only on startup.
scrypt's memory-hard nature increases denial-of-service risks under high authentication loads, as acknowledged in the README, requiring careful resource management.
Only applicable to Go projects, making it unsuitable for teams working in multiple languages or environments without Go integration.
Automatic parameter calibration is an expensive operation that must be run once on startup, which can be cumbersome in dynamic or serverless deployments.
Focuses solely on scrypt, lacking support for newer algorithms like Argon2 that might be preferred for modern password hashing standards.