Securely Hashing Passwords in Golang/App Engine without syscall or scrypt

Whilebcrypt and scrypt are commonly used for password hashing, they may not be suitable for App Engine due tosyscall accessibility. As an alternative, consider leveraging the go.crypto library for secure password hashing.

The go.crypto package offers support for both pbkdf2 and bcrypt. Both implementations are written entirely in Go, ensuring compatibility with App Engine.

1. Using bcrypt

Implement bcrypt using the following steps:

go get golang.org/x/crypto/bcrypt

Example usage:

import "golang.org/x/crypto/bcrypt"

func clear(b []byte) {
    for i := 0; i 
This will produce an output similar to:
$2a$10$sylGijT5CIJZ9ViJsxZOS.IB2tOtJ40hf82eFbTwq87iVAOb5GL8e
2. Using pbkdf2
For a simple hash using pbkdf2:
import "golang.org/x/crypto/pbkdf2"

func HashPassword(password, salt []byte) []byte {
    defer clear(password)
    return pbkdf2.Key(password, salt, 4096, sha256.Size, sha256.New)
}

pass := []byte("foo")
salt := []byte("bar")

fmt.Printf("%x\n", HashPassword(pass, salt))