Typorithm · medium

Bun.password & Hashing

bun-password-hashbunpasswordargon2idverify

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn Bun.password & Hashing

System & FFI

Bun.password.hash(pw) produces a salted argon2id hash by default (bcrypt is an option), and Bun.password.verify(pw, hash) checks an attempt. Both are async. Bun.hash() is a fast non-crypto hash for cache keys. Never store plaintext passwords.

await Bun.password.hash(pw) returns a salted, slow hash using argon2id by default; you can switch to bcrypt with { algorithm: "bcrypt", cost }. It is async because secure hashing is intentionally expensive.

await Bun.password.verify(pw, hash) compares a plaintext attempt to the stored hash and reads the algorithm and parameters out of the hash string itself, so you never re-specify them.

Bun.hash("cache-key") is a separate, fast, non-cryptographic hash meant for cache keys and deduplication — it is not salted or slow, so it must never be used for passwords.

Bun.password.hash defaults to salted argon2id; bcrypt is opt-in.

Bun.password.verify(pw, hash) checks an attempt, reading the algorithm from the hash.

Bun.hash is fast & non-crypto — for cache keys, never passwords.

const hash = await Bun.password.hash(pw);
const argon = await Bun.password.hash(pw, { algorithm: "argon2id" });
const bcrypt = await Bun.password.hash(pw, { algorithm: "bcrypt", cost: 12 });
const ok = await Bun.password.verify(pw, hash);
const id = Bun.hash("cache-key");

Read the implementation

Connect each part of the code to the concept before you type.

1. Hash a password

Bun.password.hash returns a salted argon2id hash by default — async because hashing is deliberately slow.

const hash = await Bun.password.hash(pw);

2. argon2id default

argon2id is the default, modern memory-hard algorithm; you can name it explicitly.

{ algorithm: "argon2id" }

3. bcrypt option

Pass algorithm: "bcrypt" with a cost factor when you need bcrypt compatibility.

{ algorithm: "bcrypt", cost: 12 }

4. Verify a password

Bun.password.verify checks a plaintext attempt against the stored hash and reads the algorithm from the hash itself.

const ok = await Bun.password.verify(pw, hash);

5. Fast non-crypto hash

Bun.hash is a fast, non-cryptographic hash for cache keys and dedup — never for passwords.

const id = Bun.hash("cache-key");

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.