PasswordSystem

Getting it

local PasswordSystem = Engine:GetSystem("PasswordSystem")

Overview

Some games let players set passwords: private rooms, club houses, safes, admin panels. PasswordSystem makes sure those passwords are never stored in plain text and cannot be guessed quickly.

• Hashing with Argon2id by default (scrypt and PBKDF2 also available). A hash is a single string in the standard PHC format ($argon2id$v=19$m=...) that contains the algorithm, the settings and a random salt, so you can store it anywhere, such as a DataService profile.
• Policies that check length, character classes and a blocklist.
• Locks: a password-protected thing with built-in attempt limits and lockouts per player.

It runs on the server only and uses CryptographyService underneath. Hashing is deliberately slow, so prefer the Async methods, which do the work without freezing the server.

local PasswordSystem = Engine:GetSystem("PasswordSystem")

-- When the owner sets a password
PasswordSystem:HashAsync(newPassword):andThen(function(hash)
	roomProfile:Set("PasswordHash", hash)
end)

-- When someone tries to enter
local lock = PasswordSystem:CreateLock("Room_" .. roomId, roomProfile:Get("PasswordHash"))

enterRemote.Received:Connect(function(player, args)
	lock:VerifyAsync(args[1], player):andThen(function(ok, reason)
		if ok then
			teleportIntoRoom(player)
		elseif reason == "LockedOut" then
			notify(player, "Too many tries, wait a minute.")
		else
			notify(player, "Wrong password.")
		end
	end)
end)

Hashing

Hash options override the configuration for one call: Algorithm ("Argon2id", "Argon2i", "Argon2d", "Scrypt", "PBKDF2"), SaltSize, HashSize, and the cost settings Argon2Memory, Argon2Iterations, Argon2Parallelism, ScryptN, ScryptR, ScryptP, Pbkdf2Iterations.

Passwords longer than MaxLength are rejected everywhere, to stop very long inputs being used to slow the server down.

Password rules

Reasons (PasswordSystem.PolicyReasons): "TooShort", "TooLong", "NoLetter", "NoDigit", "NoSymbol", "NoMixedCase", "Blocked". Policy overrides: MinLength, MaxLength, RequireLetter, RequireDigit, RequireSymbol, RequireMixedCase, Blocklist (compared case-insensitively).

local ok, reason = PasswordSystem:Validate(input, { MinLength = 6, Blocklist = { "password", "123456" } })

Generating

Locks

A lock combines a stored hash with attempt limiting. Attempts are counted per key: usually the player, but any string or number works (for example a team).

Options: MaxAttempts (wrong tries before lockout; 0 never locks out), AttemptWindow (seconds after which wrong tries are forgotten), LockoutSeconds.

Configuration

Types

export type Bytes = buffer | string
export type Algorithm = "Argon2id" | "Argon2i" | "Argon2d" | "Scrypt" | "PBKDF2"
export type HashOptions
export type Parsed
export type Policy
export type PolicyOptions
export type PolicyReason
export type Lock
export type LockOptions
export type LockKey = Player | string | number
export type VerifyReason = "Wrong" | "LockedOut" | "Busy"