v1.0.0

First public release.

Devise stores passwords with bcrypt. devise-hashable adds PBKDF2 and Argon2id, and migrates existing users onto them lazily — each user is re-hashed the next time they sign in successfully. No forced reset, no batch job, no downtime, and it works in both directions if you change your mind.

class User < ApplicationRecord
  devise :database_authenticatable, :registerable
  devise :password_hashable, hashing_strategy: :argon2
end

Included

• The :password_hashable Devise module.
• Hashing strategies for bcrypt, PBKDF2 and Argon2id under Devise::Hashable::Strategy.
• Configuration via hashing_strategy, digest_algorithm, hash_iterations and argon2_profile, globally or per model.
• Devise::Hashable::InvalidPasswordHash, raised when a stored hash cannot be parsed.
• Guides in docs/, covering configuration, the migration process, each strategy, and writing a custom strategy to read hashes from a system you are migrating off.

Requirements

Ruby >= 3.3. Tested against Rails 7.1, 7.2, 8.0 and 8.1, on Devise 4.9 and 5.0.

Quality

The suite is held at 100% line and branch coverage, and CI runs the full Rails × Devise matrix on Ruby 3.3 through 4.0.