verifyPassword static method

bool verifyPassword(
  1. String password,
  2. String? storedHash
)

Verifies a password against a stored hash.

  • Returns true if password matches
  • Returns false on invalid format, mismatch, or error
  • Uses constant-time comparison to prevent timing attacks

Example:

final valid = Hasher.verifyPassword('input', storedHash);

Implementation

static bool verifyPassword(String password, String? storedHash) {
  if (storedHash == null) return false;

  try {
    final parts = storedHash.split('\$');
    if (parts.length != 5 || parts[1] != 'pbkdf2-sha256') {
      throw const FormatException('Invalid hash format');
    }

    final iterations = int.parse(parts[2]);
    final salt = parts[3];
    final storedKeyB64 = parts[4];

    final computedKey = _pbkdf2(password, salt, iterations, _keyLength);
    final computedKeyB64 = base64Url.encode(computedKey);

    return _constantTimeCompare(storedKeyB64, computedKeyB64);
  } catch (e) {
    return false;
  }
}