PBKDF2 1.0.0

Haxe implementation of the PBKDF2 Algorithm for password hashing

Released 2014-06-19.

To install, run:

haxelib install PBKDF2 1.0.0

See using Haxelib in Haxelib documentation for more information.

Current version1.0.0
StatisticsInstalled 4551 times
Tags auth, cross, crypto, hash, web


PBKDF2 for Haxe

PBKDF2 (Password-Based Key Derivation Function 2) is a key derivation function that you can read all about on Wikipedia.

Basically, it lets you do a hash similar to MD5 or SHA1, but with a salt, and it can repeat thousands of times to make it harder to crack - the longer it takes to generate the key the longer it will take to crack. Anyway, it is a good way to store user passwords. Even big frameworks like Django use it by default.


To install on haxelib:

haxelib install pbkdf2

And then in your project's hxml build file, add

-lib pbkdf2

To install from the latest GIT, or from a fork:


var str = PBKDF2.encode(pass, salt, numIterations, numBytes);

It's best to use a different salt for each unique password... Here I use the helper from the Random haxelib.

user = new User();
user.username = "jason";
user.salt = Random.string(20);
user.password = PBKDF2.encode("password", user.salt, 1000, 20);

Asynchronous Usage

On targets that support haxe.Timer (flash8, flash, js, cs, java) you can use the Async version:

var onComplete = function(str:String) {
	trace ("Hash is " + str);

PBKDF2.encodeAsync("password", "salt", 1000, 20, onComplete);

Platform Support

Currently tested on Flash9, JS, CPP. Works on PHP, but our test suite doesn't run. I did some manual tests to verify though.

Neko only works with v2.0, so you'll need to install the release candidate or latest SVN. You'll also need Haxe3 (latest SVN), and you will need to use the -D neko_v2 command line option. It will not work on Neko v1.8, because the algorithm relies heavily on Bitwise Integer operations and neko v1 does not support 32bit Integers, so a lot of things were broken that I have not debugged.
Currently, neko does work but runs incredibly slowly - 60 times slower than JS and 120 times slower than CPP. Some profiling will definitely be needed.

No idea if it works on Java or C#, but quite possibly - if their Integer operations and arrays behave similarly enough.

Does not work on Flash8 (generates different numbers, have not debugged yet).

Attribution & Licence

This is a copy-of-a-copy-of-a-derivative, and a separate port:

  1. The Javascript version: Copyright (c) 2007, Parvez Anandam
    (Uses Paul Johnston's excellent SHA-1 JavaScript library sha1.js)
    Thanks to Felix Gartsman for pointing out a bug in version 1.0
    BSD License

  2. The AS3 version: http://code.google.com/p/as3-pbkdf2/
    BSD License

  3. Haxe implementation by Jason O'Neil
    BSD license

  4. The PHP implementation was derived from:
    https://defuse.ca/php-pbkdf2.htm havoc AT defuse.ca
    Released under Public Domain. Haxe translation by Jason O'Neil.

See the LICENSE.txt file for the full license.

Making Changes

  • Edit src/PBKDF2.hx
  • Add unit tests to test/PBKDF2Test.hx
  • haxelib run munit t - run unit tests, check all are passing
  • haxelib run mlib v - increment version number
  • haxelib run mlib submit - submit to Haxelib