crypto_pbkdf2_verify
Verify a plaintext password against a PBKDF2 hash by recomputing the derivation from the hash's algorithm, iterations, salt, and key length. Returns match status and parameter strength analysis.
Instructions
PBKDF2 Hash Verifier. Check whether a plaintext password matches an existing PBKDF2 hash, recomputing the derivation from the digest algorithm, iteration count, key length, and salt encoded in the hash string. Use this to verify a candidate password; use crypto_pbkdf2 instead to generate a new hash. Runs locally on the input you provide: read-only, non-destructive, contacts no external service, and is rate-limited (5 requests/min for anonymous callers). Returns whether the password matched, the parameters parsed from the hash, and a strength analysis of those parameters.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| password | Yes | The plaintext password to test against the hash. | |
| hash | Yes | The encoded PBKDF2 hash to verify against. Two formats are accepted: the passlib-style string produced by crypto_pbkdf2, $pbkdf2-<algorithm>$<iterations>$<saltHex>$<base64DerivedKey>, or a colon-delimited <algorithm>:<iterations>:<salt>:<derivedKeyHexOrBase64>. The digest algorithm, iteration count, salt, and key length are read from this string to recompute the derivation; no separate algorithm, iterations, length, or salt fields are supplied. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| password | No | The plaintext password that was tested (echoed from the request). | |
| hash | No | The encoded hash that was verified against (echoed from the request). | |
| verified | No | True when the recomputed derivation matches the digest in the supplied hash. | |
| info | No | Parameters parsed from the hash. Absent when the hash format is invalid. | |
| security | No | Strength analysis of the parsed parameters. Absent on error. | |
| verifiedAt | No | ISO 8601 timestamp of when verification ran. Absent on error. | |
| error | No | Error message when verification fails (e.g. "Invalid hash format"). Absent on success. |