The Complete Production SOP: How to Deploy and Run Argon2id Memory-Hard Password Hashing in Autonomous AI Agents

---
name: "argon2id-password-hashing-strategy"
description: "Hash and verify passwords with industry standard memory-hard Argon2id algorithm."
metadata:
  author: "P-H-C"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "hash password with argon2id"
  - "verify password argon2"
  - "configure argon2 memory cost"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Argon2id Memory-Hard Password Hashing

Implements password hashing conforming to OWASP guidelines using Argon2id: memory cost (m), time cost (t), parallelism (p), cryptographically random salting, and constant-time password verification.

## When to Invoke
Invoke this skill whenever you need to:
- hash password with argon2id
- verify password argon2
- configure argon2 memory cost

## Execution SOP & Rules
1. Use Argon2id variant exclusively (combines resistance to side-channel and GPU cracking attacks).
2. Configure OWASP recommended minimums: memoryCost: 65536 (64MB), timeCost: 3, parallelism: 1.
3. Generate a unique cryptographically secure 16-byte salt for every hashed password.
4. Perform password comparisons using constant-time string comparisons to eliminate timing leaks.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.

import { hash, verify, Algorithm } from '@node-rs/argon2';
import crypto from 'node:crypto';

const OWASP_ARGON2ID_OPTIONS = {
  algorithm: Algorithm.Argon2id,
  memoryCost: 65536, // 64 MB
  timeCost: 3,
  parallelism: 1,
  outputLen: 32
};

export async function hashPassword(plainText: string): Promise<string> {
  return hash(plainText, OWASP_ARGON2ID_OPTIONS);
}

export async function verifyPassword(plainText: string, storedHash: string): Promise<boolean> {
  try {
    return await verify(storedHash, plainText);
  } catch {
    return false;
  }
}

claude "hash password with argon2id and configure argon2 memory cost for our auth service registration endpoint"

import { describe, it, expect } from 'vitest';
import { hashPassword, verifyPassword } from './hasher';

describe('Argon2id Password Strategy SOP', () => {
  it('generates compliant argon2id formatted hash strings', async () => {
    const hash = await hashPassword('correct-horse-battery-staple');
    expect(hash).toMatch(/^\$argon2id\$v=19\$m=65536,t=3,p=1\$/);
  });

  it('verifies valid password matches and rejects invalid', async () => {
    const password = 'SuperSecurePassword#2026';
    const hash = await hashPassword(password);
    expect(await verifyPassword(password, hash)).toBe(true);
    expect(await verifyPassword('WrongPassword#2026', hash)).toBe(false);
  });
});