Hash Passwords with Argon2id

Task

Never store a user’s raw password. Add one server-side helper that hashes passwords with Argon2id and another that verifies a password against a stored hash.

Install

npm install argon2

File

Create:

lib/password.ts

Implementation

import argon2 from "argon2";

export function hashPassword(password: string) {
  return argon2.hash(password, {
    type: argon2.argon2id,
  });
}

export function verifyPassword(hash: string, password: string) {
  return argon2.verify(hash, password);
}

Keep this module server-only. Do not expose password hashing utilities to browser components.

Test

Use the helper in the registration flow to create a hash, then verify:

const hash = await hashPassword(password);
const valid = await verifyPassword(hash, password);

The original password should not equal the stored hash. Verification with the wrong password should return false.

Checkpoint

Readly has a single password boundary using Argon2id, and raw passwords are never persisted.