@node-rs/argon2

@node-rs/argon2 exposes Rust’s argon2 crate to Node.js via napi-rs, giving JavaScript applications a fast, memory-safe implementation of Argon2 — the Password Hashing Competition winner — for credential storage and key derivation. Because it’s a prebuilt native addon rather than a node-gyp build, installs are fast and don’t require a C++ toolchain on the consuming machine.

It’s one member of the node-rs monorepo, which wraps several Rust crates (bcrypt, xxhash, crc32, jieba) as Node.js bindings; argon2 is the most widely used of the set, chosen here as the canonical package given its download volume and role as the modern default for password hashing over bcrypt.

What You Get

• hash()/verify() (and sync variants) backed by Rust’s audited argon2 crate
• Support for all three Argon2 variants — Argon2d, Argon2i, and the recommended Argon2id
• Prebuilt native binaries for major platforms (including Apple Silicon) with no node-gyp/postinstall build step
• A ~476KB installed footprint versus ~3.7MB for the pure-JS node-argon2 alternative
• Configurable memory cost, time cost, and parallelism to tune hash strength versus latency

Common Use Cases

• Hashing and verifying user passwords for authentication in a Node.js backend
• Deriving encryption keys from user-supplied passphrases
• Migrating an existing bcrypt-based auth system to Argon2id for stronger memory-hardness guarantees
• Running password hashing in serverless/edge environments where fast, native-binary installs matter

Under The Hood

Architecture: packages/argon2/src/lib.rs is a thin napi-rs bridge (#[napi] annotated enums and functions) around the Rust argon2 crate’s Argon2/PasswordHasher/PasswordVerifier types; all cryptographic work happens in compiled Rust, and the generated index.d.ts/index.js glue exposes it as ordinary async/sync JS functions with no manual buffer marshaling required by consumers.

Tech Stack: Rust compiled via napi-rs to a native Node addon, with WASI fallback builds (argon2.wasi.cjs, wasi-worker.mjs) for environments without native binary support (e.g. some edge runtimes), and a global_alloc allocator crate pulled in explicitly for cross-platform memory behavior.

Code Quality: #![deny(clippy::all)] at the crate root enforces Rust lint strictness, and __test__/argon2.spec.ts exercises the hash/verify round-trip through the compiled binding rather than mocking the native layer, plus a dedicated benchmark/argon2.ts for tracking hashing throughput across releases.

API Design: The surface mirrors what JS developers expect from bcrypt-style libraries (hash, verify) rather than exposing Argon2’s full parameter complexity by default — Options (memoryCost, timeCost, parallelism) are optional with sane defaults (19 MiB/thread, Argon2id), so a working password hash requires one function call while power users can still tune every knob.