argon2id password hashing, computed on the host side with @noble/hashes.
Not computed in PHP: password_hash() is a built-in and cannot be redeclared, so the seam is
Drupal's password service (CfwPassword). The arena is a transient JS allocation (19 MiB at
the OWASP floor), measured fine beside a 117 MiB resident wasm. wasm-based argon2 libraries are
out because workerd refuses codegen at request time.
argon2id password hashing, computed on the host side with
@noble/hashes.Not computed in PHP:
password_hash()is a built-in and cannot be redeclared, so the seam is Drupal'spasswordservice (CfwPassword). The arena is a transient JS allocation (19 MiB at the OWASP floor), measured fine beside a 117 MiB resident wasm. wasm-based argon2 libraries are out because workerd refuses codegen at request time.