Home > Article > Backend Development > How to Securely Hash Passwords in Go/App Engine: Beyond bcrypt
Secure Password Hashing in Go/App Engine
When hashing user passwords in a Go/App Engine application, it's crucial to ensure the security of the implementation. This article explores alternative methods to the bcrypt library, which faces limitations on App Engine due to its use of syscall.
Alternative Options
One recommended approach is to use the go.crypto package, which provides pure Go implementations of both bcrypt and pbkdf2. These implementations are suitable for use on App Engine.
Using bcrypt
To use bcrypt, install the package using go get and import it into your code:
<code class="go">import "golang.org/x/crypto/bcrypt"</code>
To hash a password, use the GenerateFromPassword function:
<code class="go">func Crypt(password []byte) ([]byte, error) { defer clear(password) return bcrypt.GenerateFromPassword(password, bcrypt.DefaultCost) }</code>
Using pbkdf2
If you prefer a simpler hashing mechanism, you can use pbkdf2:
<code class="go">import "golang.org/x/crypto/pbkdf2" func HashPassword(password, salt []byte) []byte { defer clear(password) return pbkdf2.Key(password, salt, 4096, sha256.Size, sha256.New) }</code>
Conclusion
Both bcrypt and pbkdf2 provide secure and efficient options for password hashing in Go/App Engine applications. By using the pure Go implementations available in go.crypto, you can ensure the security and compatibility of your code.
The above is the detailed content of How to Securely Hash Passwords in Go/App Engine: Beyond bcrypt. For more information, please follow other related articles on the PHP Chinese website!