search

volatiletech / authboss

The boss of http auth.
MIT License
3.81k stars 207 forks source link

What about argon2? #288

Closed frederikhors closed 4 years ago

frederikhors commented 4 years ago

What about argon2?

https://golangcode.com/argon2-password-hashing

aarondl commented 4 years ago

I would not turn down a PR that added support for it as a non-default option. Care needs to be taken in selecting a format. One of bcrypt's advantages is that it's got a salt built-in to its output. Here we need to care about salts.