PasswordHasher class

A singleton for one-way PBKDF2-HMAC-SHA256 password hashing.

Use this when you only need to verify a password at login — you never need the original value back. This is the most secure approach for passwords stored in Firestore.

If you genuinely need to recover the original password later, use CryptoKit for two-way AES encryption instead.

Firestore workflow

// ── On registration ──────────────────────────────────────────────────────
final hashed = PasswordHasher.instance.hash(passwordCtrl.text);

await FirebaseFirestore.instance.collection('users').doc(uid).set({
  'passwordHash': hashed.combined,  // "310000:saltBase64:hashBase64"
});

// ── On login ─────────────────────────────────────────────────────────────
final doc = await FirebaseFirestore.instance.collection('users').doc(uid).get();
final ok = PasswordHasher.instance.verify(
  password: passwordCtrl.text,
  combined: doc['passwordHash'] as String,
);
if (!ok) throw Exception('Wrong password');

Why PBKDF2-HMAC-SHA256?

  • Salt — a unique 32-byte random salt per password prevents rainbow table and pre-computation attacks.
  • Iterations — 310,000 rounds (OWASP 2023 recommendation for HMAC-SHA256) make brute-force computationally expensive.
  • Constant-time comparison — verify uses a timing-safe comparison to prevent timing attacks even if an attacker can measure response times.

Properties

hashCode → int
The hash code for this object.
no setterinherited
runtimeType → Type
A representation of the runtime type of the object.
no setterinherited

Methods

hash(String password) → HashedPassword
Hashes password using PBKDF2-HMAC-SHA256.
override
isValidHash(String value) → bool
Returns true if value looks like a valid HashedPassword.combined.
noSuchMethod(Invocation invocation) → dynamic
Invoked when a nonexistent method or property is accessed.
inherited
toString() → String
A string representation of this object.
inherited
verify({required String password, required String combined}) → bool
Verifies password against a combined string from hash.

Operators

operator ==(Object other) → bool
The equality operator.
inherited

Static Properties

instance → PasswordHasher
The single instance.
final

Constants

defaultIterations → const int
PBKDF2 iterations — OWASP 2023 recommendation for HMAC-SHA256.