Effect Password Hash Vault
Password storage the way the leaked-table postmortem wishes it had been: every user gets a random 16-byte salt, the hash is scrypt (memory-hard, so each offline guess is expensive by design), and the stored record embeds its own parameters as scrypt$N$r$p$salt$hash. Verification recomputes with the record's embedded cost and compares with timingSafeEqual, unknown user and wrong password fail with one identical typed error so login cannot enumerate accounts, and a successful login through an outdated cost transparently re-hashes at the current cost, the only moment the plaintext exists being the only upgrade window. Uses node:crypto only. Pinned to effect 4.0.0-beta.98.
npx shadcn@latest add @compronents/effect-password-hash-vaultInstalls from ui.aryank.space. Needs a registry token and a one-time @compronents entry in components.json. The docs walk through both.
The table leaks, and every hash is md5(password) with no salt. A rainbow table computed years ago cracks the common passwords instantly, and identical hashes mean cracking one user cracks everyone who chose the same password. Watch the count climb: this is offline, at billions of guesses per second.