Password Hasher

security.password_hash

ProductionEngine wrapper (Class A)best-effortfastv1.0.0

No network

Overview

You pass a plaintext password; we hash it with Argon2id (default) or bcrypt using OWASP-aligned, environment-tunable work factors and return a self-describing encoded hash with parameter metadata. We never log the password. Do not use this for non-secret data, reversible encryption, or verifying passwords (use security.password_verify).

Password storage is high-stakes and easy to get wrong, and an agent should never improvise a hashing scheme. You get reviewed algorithms, adaptive work factors, and the parameters written down.

Reliability

BEST_EFFORT and non-deterministic on purpose: every hash gets a fresh random salt, so the same password gives you a different string each call. Compare with security.password_verify, never by string equality. Work factors come from the deployment configuration, so a hash made today can be weaker or stronger than one made after a retune — the parameters object records what was used. Input validation (not retryable): a missing or empty password; a password over 4096 characters, or over 72 UTF-8 bytes when you chose bcrypt; an algorithm, profile or outputFormat outside the accepted set; any pepperRef at all.

Context footprint

Encapsulates correct, reviewed password hashing in one call. A successful call costs 2 execution credits.

When to use it

Whenever you are about to store a password and need it hashed first.

For non-secret data, for anything you need to read back later, or for hashing in the browser.

Powered by Spring Security Crypto (Argon2id via Bouncy Castle, and bcrypt) — maintained, widely-audited password hashing for the JVM.

Scope

Note

Hashes a password using Argon2id or bcrypt with OWASP-aligned adaptive work factors, returning a self-describing encoded hash.

Non-goals

Does not store, transmit, or manage credentials
Does not implement custom or unreviewed hashing schemes
Does not apply a pepper from the request payload

Properties

IdempotentRetry safeStreaming supportedFile input supportedRequires external service

Capabilities

encryptionhashing

Cost & billing

Flat rate per invocation

MetercallsBillable onsuccessCost per call2 credits

File handling

Accepts file_refProduces file_refMax input4 KB

How we handle your data

Sensitive processing

What this means

This skill is designed to detect, mask, redact, validate, or otherwise process sensitive data.

Squillify guarantees

Runs inside Squillify
This skill runs inside Squillify.
Payloads are not sent to an external service by this skill.
Squillify does not permanently store submitted payloads.
Telemetry records metadata only, not submitted content.
Submitted payloads are not used for training.
Submitted payloads are not reviewed by humans.
Targets sensitive data
The response does not contain submitted content.

Your responsibility

Squillify does not determine whether submitted content is sensitive. Your application is responsible for deciding what data it is allowed to submit. Your application is responsible for securing the response.

Read the Microskill Data Handling Policy

Input schema

Field	Type	Required	Description
password	string	Yes	Plaintext password; never projected.
algorithm	string	No	Hash algorithm; omit it for argon2id.
profile	string	No	Work-factor profile; omit it for interactive.
pepperRef	string	No	Reserved unsupported pepper reference; omit it, because any supplied value is rejected.
outputFormat	string	No	Hash representation; omit it for encoded.

Output schema

Field	Type	Required	Description
hash	string	Yes	Self-describing salted password hash.
algorithm	string	Yes	Applied hash algorithm.
profile	string	Yes	Applied work-factor profile.
needsRehash	boolean	No	Whether this fresh hash needs replacement.
parameters	object	No	Algorithm-specific closed work-factor receipt with type plus Argon2 or bcrypt parameters.

API contract

POST /v1/execute

curl

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"security.password_hash","input":{"password":"correct horse battery staple","profile":"interactive"}}'

Integrations

TypeScript SDK

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("security.password_hash", {"password":"correct horse battery staple"});

Errors

Code	HTTP	Retryable	Description
VALIDATION_ERROR	400	No	The request payload failed schema validation.
UNAUTHORIZED	401	No	Missing or invalid API key.
SKILL_NOT_ACCESSIBLE	403	No	The API key is not granted access to this skill.
SKILL_NOT_AVAILABLE_FOR_PLAN	403	No	This skill is not included in your current plan.
PLAN_ELIGIBILITY_UNAVAILABLE	503	Yes	Plan eligibility could not be decided. Retry after backoff.
SKILL_NOT_FOUND	404	No	The requested skill or version does not exist.
TENANT_RATE_LIMITED	429	Yes	Request rate limit exceeded. Retry after backoff.
QUOTA_EXCEEDED	429	Yes	Plan quota exhausted. Retryable once the quota period resets.
EXECUTION_TIMEOUT	504	Yes	Execution exceeded the allowed time budget.

Other limits

Limit	Value
Recommended inline bytes	32 KiB

Limitations

Does not store, transmit, or manage credentials
Does not implement custom or unreviewed hashing schemes
Does not apply a pepper from the request payload
Hashing non-secret data (use a generic hash skill)
Reversible encryption (hashing is one-way)
High-throughput hashing inside a latency-critical request without rate limiting

How to call

POST /v1/execute (requires authentication)

Request bodyjson

{
  "skillKey": "security.password_hash",
  "input": {
    "password": "correct horse battery staple"
  }
}

Examples

Hash a new sign-up password with Argon2id

Inputjson

{
  "password": "correct horse battery staple"
}

Expected outputjson

{
  "parameters": {
    "type": "argon2id",
    "parallelism": 1,
    "saltLength": 16,
    "iterations": 2,
    "memoryKib": 19456,
    "hashLength": 32
  },
  "needsRehash": false,
  "profile": "interactive",
  "hash": "$argon2id$v=19$m=19456,t=2,p=1$HNXfOZnTHGaBjRoAWOoJlQ$f9UB95a3K9ko+kOZ7XRhJM1i0HFka2QMJOL4iI+pbNw",
  "algorithm": "argon2id"
}

Tip

Defaults give you argon2id at the interactive profile; the salt is fresh every call, so the hash string differs each time

Stay compatible with a bcrypt credential store