Devise::Hashable

Modern password hashing for Devise, with no forced password reset.

Devise stores passwords with bcrypt. This gem adds PBKDF2 and Argon2id, and migrates your existing users onto them one at a time, as each signs in. Nobody is locked out, nothing is reset, and you can change your mind and move back.

Requires Ruby 3.3 or newer. Tested against Rails 7.1, 7.2, 8.0 and 8.1, on Devise 4.9 and 5.0.

bundle add devise-hashable

Add :password_hashable to your Devise model and name a strategy:

class User < ApplicationRecord
  devise :database_authenticatable, :registerable
  devise :password_hashable, hashing_strategy: :argon2
end

That is the whole setup. The next time each user signs in, their password is verified against its existing hash and then re-hashed with Argon2id.

If you would rather confirm the wiring before anything changes, start by naming the scheme you already use. Nothing will be re-hashed:

devise :password_hashable, hashing_strategy: :bcrypt

• Configuration — every setting, and where to put it
• Migrating passwords — how the migration runs, when it is skipped, and how to roll it out
• Custom strategies — read hashes from a system you are migrating off

After checking out the repo, run bin/setup to install dependencies. Then run rake test to run the tests, or bin/console for an interactive prompt.

The suite is written in Minitest, deliberately, so that public Devise modules can be imported and plugged straight into it. It is held at 100% line and branch coverage — raise the floors in test/test_helper.rb when coverage improves, never lower one to make a run pass.

bundle exec appraisal install sets up the Rails and Devise combinations that CI runs; bundle exec appraisal rake test runs the whole matrix locally.

Bug reports and pull requests are welcome on GitHub at https://github.com/MatthewKennedy/devise-hashable/issues.

devise-hashable is free to use under the MIT licence, and maintained in spare time. If it saves you some, you can sponsor its development.

Sponsorship buys no support commitment and no influence over what gets built — bug reports and pull requests are as welcome from everyone as they always were.

The gem is available as open source under the terms of the MIT License.