Devise::Hashable
Modern password hashing for Devise, with no forced password reset.
Devise stores passwords with bcrypt. This gem adds PBKDF2 and Argon2id, and migrates your existing users onto them one at a time, as each signs in. Nobody is locked out, nothing is reset, and you can change your mind and move back.
Requires Ruby 3.3 or newer. Tested against Rails 7.1, 7.2, 8.0 and 8.1, on Devise 4.9 and 5.0.
Installation
bundle add devise-hashable
Usage
Add :password_hashable to your Devise model and name a strategy:
class User < ApplicationRecord
devise :database_authenticatable, :registerable
devise :password_hashable, hashing_strategy: :argon2
end
That is the whole setup. The next time each user signs in, their password is verified against its existing hash and then re-hashed with Argon2id.
If you would rather confirm the wiring before anything changes, start by naming the scheme you already use. Nothing will be re-hashed:
devise :password_hashable, hashing_strategy: :bcrypt
Strategies
| Strategy | Choose it when |
|---|---|
| Argon2id | You are free to pick on security grounds. Memory-hard, RFC 9106 |
| PBKDF2 | You need a FIPS-aligned KDF |
| Bcrypt | You want Devise's existing behaviour, unchanged |
Documentation
- Configuration — every setting, and where to put it
- Migrating passwords — how the migration runs, when it is skipped, and how to roll it out
- Custom strategies — read hashes from a system you are migrating off
Development
After checking out the repo, run bin/setup to install dependencies. Then run
rake test to run the tests, or bin/console for an interactive prompt.
The suite is written in Minitest, deliberately, so that public Devise modules can
be imported and plugged straight into it. It is held at 100% line and branch
coverage — raise the floors in test/test_helper.rb when coverage improves,
never lower one to make a run pass.
bundle exec appraisal install sets up the Rails and Devise combinations that CI
runs; bundle exec appraisal rake test runs the whole matrix locally.
Contributing
Bug reports and pull requests are welcome on GitHub at https://github.com/MatthewKennedy/devise-hashable/issues.
License
The gem is available as open source under the terms of the MIT License.