Quickstart

Five short tasks with the exact output each one prints, from hashing a string to checking a one-time password.

Every snippet below is a complete program. The comment after each call is what it actually returns.

#Hash a string

import { hash } from "unsecure/hash";

await hash("hello world");
// "b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9"

await hash("hello world", { returnAs: "base64" });
// "uU0nuZNNPgilLlLX2n2r+sSE7+N6U4DukIj3rOLvzek="

await hash("hello world", { algorithm: "SHA-512" });
// "309ecc489c12d6eb4cc40f50c902f2b4d0ed77ee511a7c7a9bcd3ca86d4cd86f989dd35bc5ff…"

A string in gives you hex out. Bytes in give you bytes out. Say returnAs when you want something else.

#Sign and verify a message

import { hmac, hmacVerify } from "unsecure/hmac";

const signature = await hmac("secret-key", "payload");
// "10aa2e1c2538464ff75f0647271e3ba746bca3fcdeaf322c581bf5851e8cddb7"

await hmacVerify("secret-key", "payload", signature); // true
await hmacVerify("secret-key", "payload", null); // false
await hmacVerify("secret-key", "payload", "00".repeat(32)); // false

hmacVerify compares in constant time and never throws on a bad signature. A null header is a false, not an exception.

#Store a password

import { argon2Hash, argon2Verify } from "unsecure/argon2";

const stored = await argon2Hash("correct horse battery staple");
// "$argon2id$v=19$m=19456,t=2,p=1$MDEyMzQ1Njc4OWFiY2RlZg$gy5SuVm5Z7Vw7keB9se9p8…"

await argon2Verify(stored, "correct horse battery staple"); // true
await argon2Verify(stored, "hunter2"); // false

The salt is generated for you and travels inside the string, so one text column is the whole storage format.

#Generate an identifier and a token

import { uuidv7, uuidv7Timestamp } from "unsecure/uuid";
import { secureGenerate } from "unsecure/generate";

const id = uuidv7();
// "01a076ba-1e53-7411-8518-84905f353e3d"

new Date(uuidv7Timestamp(id));
// the millisecond the id was made

secureGenerate({ length: 32, specials: false });
// "eO1k3t091l72uZTqhY050kEJ6vdB0j0V"

uuidv7 sorts by creation time, which is what makes it a friendlier database key than uuidv4.

#Check a one-time password

import { generateOTPSecret, otpauthURI, totpVerify } from "unsecure/otp";

const secret = generateOTPSecret();
// a 32-character base32 string, 20 random bytes

otpauthURI({ type: "totp", secret, account: "user@example.com", issuer: "My App" });
// "otpauth://totp/My%20App:user%40example.com?secret=…&issuer=My%20App&algorithm=SHA1&digits=6&period=30"

await totpVerify(secret, "287082");
// { valid: false, delta: 0 }  — or { valid: true, delta: 0, step: 59623316 }

Render the URI as a QR code, store the secret, and check the six digits the app shows.

#Next

Recipes puts these together into whole tasks.
Errors is the one page to read before writing a catch.

Edit this page

Previous Installation Next Migration guides

On this page