Password Verifier

security.password_verify

ProductionEngine wrapper (Class A)Deterministicstrictfastv1.0.0

No network

Overview

You pass a plaintext password and an encoded Argon2id or bcrypt hash; we verify them with constant-time comparison and tell you whether the stored hash should be upgraded to your target work-factor profile. We never log the password. Do not use this for arbitrary hash equality, non-password data, or string-comparing hashes yourself.

Password verification must use the same safe rules as hashing — you should never compare hashes directly or let an agent invent verification logic.

Reliability

STRICT and deterministic for a given password and hash. We use constant-time verification; unrecognized or malformed hashes return match=false with reason=unrecognized_or_malformed_hash (not an error). Input validation (not retryable): missing password or hash; password or hash out of range; unsupported targetProfile or pepperRef.

Context footprint

Encapsulates correct, constant-time password verification in one call. A successful call costs 2 execution credits.

When to use it

When you verify a login password or credential against a stored Argon2id/bcrypt hash.

For non-password comparisons, arbitrary hash equality, or verifying without security.password_hash output.

Powered by Spring Security Crypto (Argon2id via Bouncy Castle, and bcrypt) — maintained, widely-audited password verification for the JVM.

Scope

Note

Verifies a plaintext password against an encoded Argon2id or bcrypt hash using the library's constant-time matcher, and advises on rehashing.

Non-goals

Does not compare hashes by string equality
Does not store or manage credentials
Does not implement custom verification logic

Properties

IdempotentRetry safeStreaming supportedFile input supportedRequires external service

Capabilities

hashingvalidation

Cost & billing

Flat rate per invocation

MetercallsBillable onsuccessCost per call2 credits

File handling

Accepts file_refProduces file_refMax input4 KB

How we handle your data

Sensitive processing

What this means

This skill is designed to detect, mask, redact, validate, or otherwise process sensitive data.

Squillify guarantees

Runs inside Squillify
This skill runs inside Squillify.
Payloads are not sent to an external service by this skill.
Squillify does not permanently store submitted payloads.
Telemetry records metadata only, not submitted content.
Submitted payloads are not used for training.
Submitted payloads are not reviewed by humans.
Targets sensitive data
The response does not contain submitted content.

Your responsibility

Squillify does not determine whether submitted content is sensitive. Your application is responsible for deciding what data it is allowed to submit. Your application is responsible for securing the response.

Read the Microskill Data Handling Policy

Input schema

Field	Type	Required	Description
password	string	Yes	Plaintext candidate password; never projected.
hash	string	Yes	Stored encoded password hash.
pepperRef	string	No	Reserved unsupported pepper reference; omit it, because any supplied value is rejected.
targetProfile	string	No	Target work-factor profile; omit it for interactive.

Output schema

Field	Type	Required	Description
match	boolean	Yes	Whether the password matches.
needsRehash	boolean	Yes	Whether a matching hash is below the target profile.
algorithm	string	No	Recognized stored-hash algorithm.
reason	string	No	Safe optional rehash or malformed-hash reason.

API contract

POST /v1/execute

curl

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"security.password_verify","input":{"password":"correct horse battery staple","hash":"$argon2id$v=19$..."}}'

Integrations

TypeScript SDK

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("security.password_verify", {"hash":"$argon2id$v=19$m=19456,t=2,p=1$HNXfOZnTHGaBjRoAWOoJlQ$f9UB95a3K9ko+kOZ7XRhJM1i0HFka2QMJOL4iI+pbNw","password":"correct horse battery staple"});

Errors

Code	HTTP	Retryable	Description
VALIDATION_ERROR	400	No	The request payload failed schema validation.
UNAUTHORIZED	401	No	Missing or invalid API key.
SKILL_NOT_ACCESSIBLE	403	No	The API key is not granted access to this skill.
SKILL_NOT_AVAILABLE_FOR_PLAN	403	No	This skill is not included in your current plan.
PLAN_ELIGIBILITY_UNAVAILABLE	503	Yes	Plan eligibility could not be decided. Retry after backoff.
SKILL_NOT_FOUND	404	No	The requested skill or version does not exist.
TENANT_RATE_LIMITED	429	Yes	Request rate limit exceeded. Retry after backoff.
QUOTA_EXCEEDED	429	Yes	Plan quota exhausted. Retryable once the quota period resets.
EXECUTION_TIMEOUT	504	Yes	Execution exceeded the allowed time budget.

Other limits

Limit	Value
Recommended inline bytes	32 KiB

Limitations

Does not compare hashes by string equality
Does not store or manage credentials
Does not implement custom verification logic
Comparing arbitrary hashes
Verifying non-password data
Unbounded verification without platform rate limiting

How to call

POST /v1/execute (requires authentication)

Request bodyjson

{
  "skillKey": "security.password_verify",
  "input": {
    "hash": "$argon2id$v=19$m=19456,t=2,p=1$HNXfOZnTHGaBjRoAWOoJlQ$f9UB95a3K9ko+kOZ7XRhJM1i0HFka2QMJOL4iI+pbNw",
    "password": "correct horse battery staple"
  }
}

Examples

Correct password

Inputjson

{
  "hash": "$argon2id$v=19$m=19456,t=2,p=1$HNXfOZnTHGaBjRoAWOoJlQ$f9UB95a3K9ko+kOZ7XRhJM1i0HFka2QMJOL4iI+pbNw",
  "password": "correct horse battery staple"
}

Expected outputjson

{
  "match": true,
  "algorithm": "argon2id",
  "needsRehash": false
}

Wrong password