Lacspace Devs
← All packages

@lacspace/password

v1.1.1Security Kit1 @lacspace dep

Password hashing & verification — PBKDF2-HMAC-SHA256 (OWASP iterations, portable PHC string) plus a zxcvbn-style strength estimator, k-anonymity breach check, a configurable policy evaluator, and CSPRNG passphrase/password generators. Isomorphic over Web Crypto.

npm i @lacspace/password
View on npm ↗Try in the playground →GitHub ↗

Usage

password.ts
import { hash, verify, needsRehash, strength } from "@lacspace/password";

const stored = await hash("correct horse battery staple");
// "$pbkdf2-sha256$i=600000$<salt>$<hash>"  — store this string

await verify("correct horse battery staple", stored); // true
await verify("wrong", stored);                          // false

if (needsRehash(stored)) { /* re-hash with current params after a successful login */ }

strength("password");        // { score: 0, warnings: ["This is a very common password."] }
strength("Tr0ub4dour&3xy");  // { score: 4, warnings: [] }

Exports 4

hashneedsRehashstrengthverify

Keywords

passwordhashpbkdf2password-hashingverifyphcbreach-checkhaveibeenpwnedpassword-strengthpassphrasepassword-policy

More in Security Kit

@lacspace/apikey

Issue & verify API keys the right way — prefixed high-entropy keys, store only the SHA-256 hash, constant-time verify, plus a storage-agnostic record toolkit: public fingerprints, hierarchical scopes, expiry, key rotation with a grace window, and revocation. Isomorphic over Web Crypto.

@lacspace/crypto

Safe, boring cryptography over Web Crypto — authenticated AES-256-GCM, PBKDF2/HKDF key derivation, SHA-256/384/512, HMAC, timing-safe compare and unbiased secure random (tokens, UUIDs, integers). Isomorphic (Node, edge, browser, RN).

@lacspace/headers

Secure HTTP headers & a typed Content-Security-Policy builder — HSTS, CSP nonces & hashes, a typed Permissions-Policy, COOP/COEP/CORP cross-origin isolation, Reporting-Endpoints and report-only, plus ready-made strict and API presets. Framework-agnostic + Next.js. Zero-dependency, isomorphic.

@lacspace/jwt

JSON Web Tokens over Web Crypto — HS/RS/ES/EdDSA signing, JWK/JWKS with kid-based key rotation, and strict expiry/issuer/audience/subject/jti checks. Plus refresh-token rotation and CSRF tokens. Isomorphic — Node, edge, browser.

@lacspace/lock

Account lockout & brute-force protection (server lock) — N-strikes with exponential or progressive/tiered backoff, per-account + per-IP composite locking, allow/deny lists, and a CAPTCHA step-up threshold before hard lockout. Pluggable store, zero-dependency, isomorphic.

@lacspace/mfa

Orchestrate multi-factor auth — combine password + TOTP + passkeys into 2FA/3FA step-up flows with NIST assurance levels (AAL), now with factor enrollment flows, failed-attempt lockout, trusted-device tokens and recovery codes. Isomorphic (bar @lacspace/otp).

← Browse all 197 packagesRead the handbook