Josephan.PasswordHashing 1.0.4

🔐 Josephan.PasswordHashing

Lightweight and secure password hashing library for .NET using Argon2id, with clean Dependency Injection support and configurable options.

✨ Features

• 🔒 Secure password hashing using Argon2id
• ⚙️ Fully configurable hashing options
• 🧩 Clean integration with Dependency Injection
• 📦 Lightweight and minimal API surface
• 🛡️ Constant-time password verification (timing attack resistant)
• 📄 PHC string format support (self-contained hash)

📦 Installation

dotnet add package Josephan.PasswordHashing

📖 Usage

Register with default options

// Program.cs — sensible defaults, zero config needed
builder.Services.AddPasswordHashing();

Register with custom options

builder.Services.AddPasswordHashing(options =>
{
    options.MemorySize          = 65536;  // 64 MB
    options.Iterations          = 3;
    options.DegreeOfParallelism = 4;
});

Hash a password

public class AuthService(IPasswordHasher passwordHasher)
{
    public string RegisterUser(string plainPassword)
    {
        // Returns a self-contained PHC string — salt & params embedded:
        // $argon2id$v=19$m=65536,t=3,p=4$c2FsdHNhbHRz$hashedvalue...
        return passwordHasher.HashPassword(plainPassword);
    }
}

Verify a password

public class AuthService(IPasswordHasher passwordHasher)
{
    public bool Login(string storedHash, string plainPassword)
    {
        // Constant-time comparison — safe against timing attacks
        bool isValid = passwordHasher.VerifyPassword(storedHash, plainPassword);

        if (!isValid)
            throw new UnauthorizedAccessException("Invalid credentials.");

        return true;
    }
}

Full round-trip

// 1. Hash on registration
string hash = passwordHasher.HashPassword("MyS3cur3P@ssword!");
// → "$argon2id$v=19$m=65536,t=3,p=4$..."  ← store this in your DB

// 2. Verify on login
bool match = passwordHasher.VerifyPassword(hash, "MyS3cur3P@ssword!");  // true
bool wrong = passwordHasher.VerifyPassword(hash, "WrongPassword");      // false

💡 The PHC string is self-contained — salt, algorithm, and parameters are all embedded in the hash. You never need to store the salt separately.

🐙 GitHub Repository

github.com/yousefyahia828/Josephan.PasswordHashing

📄 License

MIT © Yousef Yahia