Hashing and security filters

Cryptographic digests and password hashes. All are Pagelove extensions.

sha256

Produces a hex-encoded SHA-256 hash of the input string.

{{ "hello" | sha256 }}

Output: 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

bcrypt

Produces a bcrypt hash of the input string. The optional argument sets the cost (default 12).

{{ "password" | bcrypt }}
{{ "password" | bcrypt: 10 }}

argon2

Produces an Argon2id hash of the input string. Returns a PHC-format string by default.

{{ "password" | argon2 }}
{{ "password" | argon2: memory: 65536, time: 3 }}
Parameter Default Description
format "phc" Output format: "phc" (standard PHC string) or "raw" (hex-encoded)
salt — Salt to use in "raw" mode. Required when format: "raw"; at least 8 bytes. Ignored in PHC mode.
memory 19456 Memory cost in KiB (minimum 8)
time 2 Time cost / iterations (minimum 1)
length 32 Output hash length in bytes (4–64)

The default PHC output is self-describing: the string embeds the salt and parameters, so it can be verified later (re-hash the candidate and compare). format: "raw" returns only the hex-encoded digest bytes, which have nowhere to carry a salt — so raw mode requires an explicit salt: (otherwise the random salt would be discarded, leaving a digest that can never be reproduced). Supply a stable salt so the value is deterministic:

{{ "password" | argon2: format: "raw", salt: "per-user-unique-salt" }}

For password storage, prefer the default PHC format unless you are managing salts yourself.

See also