Avoid writing your own password and token code

How to do it

Each of these has small details that decide whether accounts are safe, and a mistake shows no symptom until an attacker finds it. Maintained libraries and services have had those mistakes found and fixed by thousands of users. Use the passkey library or Keycloak above, or a framework's own sign-in. Pick between them as Decide whether a provider or a library runs sign-in says. Store passwords as Store passwords with a slow hash says.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

JavaScript example

import argon2 from 'argon2';

export const hashPassword = (password) => argon2.hash(password);

Python example

from argon2 import PasswordHasher

hasher = PasswordHasher()

def hash_password(password: str) -> str:
    return hasher.hash(password)

Related rules

• Decide whether a provider or a library runs sign-in in Accounts
• Store passwords with a slow hash in Security testing