Password Hasher NG

Deterministic per-site password generator: one memorized master key + a public site tag → a reproducible strong password. No input is ever stored or sent — nothing leaves the page (the only thing kept locally is the UI theme preference).

Continuation of Password Hasher by Steve Cooper (2006), with a hardened v2 algorithm and a native CLI.

Components

• Web tool — index.html, a single offline-first page (no network calls, works from a local file). Ships both algorithms:
  • v2 (default): PBKDF2-HMAC-SHA-256 (WebCrypto, 210 000 iterations), UTF-8 safe, unbiased alphabet mapping via rejection sampling.
  • v1 (legacy): HMAC-SHA-1 construction of the original Password Hasher, kept for compatibility with existing passwords.
• CLI — passhash-ng-cli/, a Rust implementation (static musl binary, .deb packaging) matching both algorithms bit-for-bit, cross-checked in both directions: v2 has Rust as the reference and the browser is verified against it (scripts/verify-browser-v2.js); v1 has the browser as the reference and Rust is verified against golden vectors derived from the original JS (passhash-ng-cli/scripts/derive-v1-vectors.js).

Security model

Kerckhoffs: algorithm, options and site tags are public; the only secret is the master key. Derived passwords do not practically leak the key (v2 additionally slows offline guessing via PBKDF2). Full threat model and design rationale: plans/security-review.md.

Hosted version

https://devthefuture-org.github.io/passhash-ng/ — same file as index.html; for maximum paranoia, download the repo and open it locally.

License

MPL-2.0. Files inherited from the original Password Hasher (Password Hasher NG_fichiers/passhash-common.js, passhash-sha1.js) retain their MPL 1.1/GPL 2.0/LGPL 2.1 tri-license headers, © 2006 Steve Cooper.