Systems

vauth

Password hashing, one time codes and signed tokens, for checking who someone is.

Released v1.0.0 · 2026-09-28

Import

use "stdlib/auth.ven"

vauth.ven

hashed = hash_password("hunter2")
print verify_password("hunter2", hashed)

Reference (12 functions)

hash_password
verify_password
generate_totp_secret
hex_digit_value
totp_code_from_digest
totp_time_counter
generate_totp
totp_code_for_counter
verify_totp
merged_with_expiry
create_signed_token
verify_token

API reference

`hash_password(password)`

Hashes password into a salted, storable Text.

verify_password("hunter2", hash_password("hunter2"))

`verify_password(password, stored_hash)`

Tests whether password matches the salted hash stored_hash.

h = hash_password("hunter2")
verify_password("hunter2", h)

`generate_totp_secret()`

Generates a fresh, random TOTP secret.

length(generate_totp_secret())

`hex_digit_value(ch)`

Gives back the numeric value of one lowercase hex digit.

hex_digit_value("a")

`totp_code_from_digest(digest)`

totp_code_from_digest(hmac_sha256("s3cr3t", "42"))

`totp_time_counter(time_step_seconds)`

Gives back the current TOTP time counter for a time_step_seconds window.

totp_time_counter(30) >= 0

`generate_totp(secret, time_step_seconds)`

Generates the current TOTP code for secret.

length(generate_totp("fixed-secret", 30))

`totp_code_for_counter(secret, counter)`

Computes the TOTP code for secret at one specific, already-known counter.

totp_code_for_counter("s3cr3t", 12345)

`verify_totp(secret, code, time_step_seconds)`

Tests whether code is a valid current TOTP code for secret.

secret = "s3cr3t"
counter = totp_time_counter(30)
verify_totp(secret, totp_code_for_counter(secret, counter), 30)

`merged_with_expiry(claims, expires_in_seconds)`

Copies claims into a new map with an "exp" expiry field added.

claims = new_map()
map_set(claims, "user", "ada")
map_get(merged_with_expiry(claims, 60), "user")

`create_signed_token(claims, secret, expires_in_seconds)`

Builds a signed, JWT-shaped token out of claims.

claims = new_map()
map_set(claims, "user", "ada")
token = create_signed_token(claims, "top-secret-key", 3600)
map_get(verify_token(token, "top-secret-key"), "user")

`verify_token(token, secret)`

Verifies a signed token and gives back its claims.

claims = new_map()
map_set(claims, "user", "ada")
token = create_signed_token(claims, "top-secret-key", 3600)
verify_token(token, "wrong-secret-key")

API reference

Get notified when vauth changes