A feed of the latest and greatest ForgeBox package entries https://www.forgebox.io/ Ortus Solutions, Corp (www.ortussolutions.com) http://www.rssboard.org/rss-specification FeedGenerator Wed, 08 Jul 2026 01:33:49 GMT Wed, 08 Jul 2026 01:33:49 GMT FusionReactor 2026.1.3 jar and debug libraries. See https://www.fusion-reactor.com https://forgebox.io/view/FusionReactor Mon, 29 Jun 2026 16:22:55 GMT projects https://forgebox.io/view/FusionReactor # cf-passwordhash A single bundled JAR plus a ColdFusion CFC that backports the ColdFusion 2025 `passwordHashGenerate` / `passwordHashVerify` password-hashing API to CF2016-CF2025, Lucee 5/6/7, and BoxLang. Drop in the JAR, call the same function names you will use on CF2025, and a future engine upgrade needs no code changes and no data migration. ## Why this exists ColdFusion 2025 introduced a unified password-hashing API covering Argon2, BCrypt, and SCrypt. That API is stranded on CF2025 alone. If your application runs on an older Adobe CF version, Lucee, or BoxLang, you previously had no standard way to produce or verify those hashes. This library gives you the identical call signatures and byte-for-byte compatible hash output on older engines, so upgrading to CF2025 later is a no-op at both the code and the database layer. ## Supported engines All eleven configurations below pass the full no-TestBox test suite: | Engine | Tested version | |------------------|---------------| | Adobe CF | 2016, 2018, 2021, 2023, 2025 | | Lucee | 5, 6, 7 | | BoxLang | latest (native, adobe-compat, lucee-compat) | On BoxLang the library needs the `bx-compat-cfml` module so that `createObject("java", ...)` and the CFC behave the way they do on Adobe CF and Lucee. The bundled BoxLang server configs install it on first run. ## Hash compatibility - **Argon2, BCrypt, SCrypt** - hashes produced by this library are byte-for-byte identical to hashes produced by CF2025's native functions. Parity is proven bidirectionally: hashes generated here verify on CF2025, and hashes generated on CF2025 verify here. - **PBKDF2** - CF2025 has no native PBKDF2 function, so there is nothing to be compatible with. This library uses a self-describing format: `$pbkdf2-sha256$i=ITERATIONS$SALT$HASH`. It also verifies legacy colon-delimited `iterations:salt:hash` (SHA1) hashes so you can migrate existing records without a bulk rehash. ## Installation Choose exactly one of these two methods. Using both at the same time double-loads the JAR and causes class conflicts. ### Option 1 - CommandBox libDirs (recommended) Copy `lib/cf-passwordhash-1.0.0.jar` into a folder that is declared as `libDirs` in your `server.json`: ```json { "app": { "libDirs": "./lib" } } ``` Restart the server. The JAR is on the classpath automatically. ### Option 2 - Application.cfc javaSettings Copy `lib/cf-passwordhash-1.0.0.jar` into a `lib/` folder next to your `Application.cfc`, then add: ```cfc this.javaSettings = [ "loadPaths": [ expandPath("./lib") ], "loadColdFusionClassPath": false, "reloadOnChange": false ]; ``` ## Usage - CFC Copy `PasswordHash.cfc` into your project root (or any mapped folder). Then: ```cfc svc = new PasswordHash(); // Generate a hash using the default algorithm (Argon2) hash = svc.passwordHashGenerate( password ); // Verify a password against a stored hash (algorithm auto-detected from the hash prefix) ok = svc.passwordHashVerify( password, hash ); // Specify an algorithm explicitly hash = svc.passwordHashGenerate( password, "BCrypt" ); ok = svc.passwordHashVerify( password, hash, "BCrypt" ); // Pass custom options (ordered struct literal) hash = svc.passwordHashGenerate( password, "Argon2", [ "MEMORYCOST": 19456, "CPUCOST": 2 ] ); // Inspect a stored hash info = svc.passwordHashInfo( hash ); // returns a map describing the hash. Keys are uppercase and vary by algorithm // (for example ALGORITHM, plus the cost parameters embedded in the hash). // Read keys with bracket access and the exact uppercase name so it works the // same on Adobe CF, Lucee, and BoxLang: alg = info[ "ALGORITHM" ]; ``` ## Usage - global shim (CF2025-style unqualified calls) On any engine that does NOT have the native CF2025 functions, include the shim once - either in `Application.cfc` or at the top of each template that needs it: ```cfm ``` After that, call the functions exactly as you would on CF2025: ```cfc hash = passwordHashGenerate( password ); ok = passwordHashVerify( password, hash ); info = passwordHashInfo( hash ); ``` **Important:** do NOT include the shim on CF2025. The shim declares functions with the same names as the built-ins, which causes a name collision. On CF2025 the native functions are already available - just call them directly or use the CFC wrapper. ## Algorithm options ### Argon2 (default) | Option | Default | Notes | |--------------|---------|-------------------------------| | SALTLENGTH | 16 | bytes | | HASHLENGTH | 32 | bytes of derived key | | PARALLEL | 1 | parallelism factor | | MEMORYCOST | 4096 | kilobytes of memory | | CPUCOST | 3 | time-cost iterations | ### BCrypt | Option | Default | Notes | |----------|---------|------------------------------| | ROUNDS | 10 | log2 cost factor (4-31) | | VERSION | $2a | BCrypt version string | ### SCrypt | Option | Default | Notes | |--------------|---------|------------------------------| | SALTLENGTH | 16 | bytes | | KEYLENGTH | 32 | bytes of derived key | | PARALLEL | 1 | parallelism factor | | MEMORYCOST | 8 | block size parameter (r) | | CPUCOST | 16384 | CPU/memory cost (N), must be power of 2 | ### PBKDF2 | Option | Default | Notes | |--------------|---------|------------------------------| | CPUCOST | 210000 | iteration count (time cost) | | SALTLENGTH | 16 | bytes | | KEYLENGTH | 32 | bytes of derived key | ## Building from source A prebuilt JAR is committed to `lib/` so you do not need to build. If you want to build from source: On Windows: ```powershell pwsh ./build.ps1 ``` On macOS/Linux: ```bash ./build.sh ``` The build scripts download Bouncy Castle (`bcprov-jdk18on-1.78.1.jar`) from Maven Central, compile the Java source with `javac --release 8`, assemble a fat shaded JAR, and copy it to both `dist/` and `lib/`. ## Running the tests Start a server for any engine: ```bash box server start serverConfigFile=server.cf2025.json ``` Then open `http://localhost:8925/tests/runner.cfm` in a browser (replace the port with the one for the engine you started). The runner executes all test files and reports pass/fail counts. Server config files are provided for all eleven tested configurations. Port assignments: | File | Engine | Port | |--------------------------|-----------------|------| | server.cf2016.json | Adobe CF 2016 | 8916 | | server.cf2018.json | Adobe CF 2018 | 8918 | | server.cf2021.json | Adobe CF 2021 | 8921 | | server.cf2023.json | Adobe CF 2023 | 8923 | | server.cf2025.json | Adobe CF 2025 | 8925 | | server.lucee5.json | Lucee 5 | 8935 | | server.lucee6.json | Lucee 6 | 8936 | | server.lucee7.json | Lucee 7 | 8937 | | server.boxlang.json | BoxLang | 8940 | | server.boxlang-adobe.json| BoxLang (Adobe) | 8941 | | server.boxlang-lucee.json| BoxLang (Lucee) | 8942 | ## Project structure ``` cf-passwordhash/ lib/ cf-passwordhash-1.0.0.jar prebuilt fat JAR (Bouncy Castle bundled) include/ PasswordHashFunctions.cfm optional global-shim UDFs tests/ runner.cfm test runner (no TestBox required) test-argon2.cfm test-bcrypt.cfm test-scrypt.cfm test-pbkdf2.cfm test-cfc.cfm test-shim.cfm test-native-2025.cfm parity test against CF2025 built-ins ... PasswordHash.cfc CFC wrapper Application.cfc dev application component index.cfm quick-start demo box.json build.ps1 build.sh ``` ## License MIT - see [LICENSE](LICENSE). This library bundles Bouncy Castle (`bcprov-jdk18on` 1.78.1). See [THIRD-PARTY-NOTICES.txt](THIRD-PARTY-NOTICES.txt) for the Bouncy Castle licence text. https://forgebox.io/view/cf-passwordhash Mon, 29 Jun 2026 02:15:28 GMT projects https://forgebox.io/view/cf-passwordhash Cross-engine CFML client for the ipLogs.com IP reputation / VPN detection API with caching and offline datasets. https://forgebox.io/view/iplogs Fri, 05 Jun 2026 00:42:08 GMT projects https://forgebox.io/view/iplogs API Documentation generator for BoxLang classes using JavaDoc conventions https://forgebox.io/view/bx-docbox Mon, 19 Jan 2026 17:12:45 GMT projects https://forgebox.io/view/bx-docbox API Documentation generator for BoxLang and CFML classes using JavaDoc conventions https://forgebox.io/view/docbox Mon, 19 Jan 2026 17:12:35 GMT projects https://forgebox.io/view/docbox A ColdFusion library for easy Data Access, CRUD, ORM like functionality and LINQ style query building. https://forgebox.io/view/dao Fri, 06 Mar 2026 22:09:14 GMT projects https://forgebox.io/view/dao Socket.IO Server Protocol implementation for Lucee 5 applications https://forgebox.io/view/socketiolucee Fri, 16 Jan 2026 14:42:09 GMT projects https://forgebox.io/view/socketiolucee A boilerplate-reduction library for using the Java Concurrency Framework in ColdFusion applications https://forgebox.io/view/cfconcurrent Wed, 07 Jan 2026 23:06:35 GMT projects https://forgebox.io/view/cfconcurrent A sweet package to do raffles with https://forgebox.io/view/rafflebox Fri, 02 May 2025 19:55:28 GMT projects https://forgebox.io/view/rafflebox WebSockets Console for ColdFusion https://forgebox.io/view/coldfusion-websockets-console Sat, 05 Oct 2024 04:15:43 GMT projects https://forgebox.io/view/coldfusion-websockets-console Simple JavaScript Utility for ColdFusion WebSockets https://forgebox.io/view/advancedsocket Sat, 05 Oct 2024 04:08:32 GMT projects https://forgebox.io/view/advancedsocket A ColdFusion CFC to interact with the chatgpt API https://forgebox.io/view/chatgpt Tue, 21 Mar 2023 17:52:33 GMT projects https://forgebox.io/view/chatgpt A ColdFusion component to manage generating access tokens, refresh token and authorization codes https://forgebox.io/view/oauth2-server Wed, 28 Sep 2022 13:47:40 GMT projects https://forgebox.io/view/oauth2-server A ColdFusion wrapper to interact with OAuth2 provider https://forgebox.io/view/oauth2-providers Tue, 27 Sep 2022 18:05:11 GMT projects https://forgebox.io/view/oauth2-providers A CFML component to manage generation of PKCE values for the OAuth2 protocol. https://forgebox.io/view/pkce Tue, 27 Sep 2022 11:05:57 GMT projects https://forgebox.io/view/pkce A CFML component to interact with the SecondHandSongs API https://forgebox.io/view/secondhandsongs-api Mon, 12 Sep 2022 09:34:27 GMT projects https://forgebox.io/view/secondhandsongs-api Some examples on ways of using Coldbox with an existing codebase https://forgebox.io/view/coldbox-existing-code-blog Mon, 08 Aug 2022 03:02:23 GMT projects https://forgebox.io/view/coldbox-existing-code-blog A presentation for Into The Box 2021 on Adding ColdBox to Existing Codebase. https://forgebox.io/view/itb2021_adding_coldbox_to_an_existing_codebase Fri, 24 Sep 2021 18:54:20 GMT projects https://forgebox.io/view/itb2021_adding_coldbox_to_an_existing_codebase A presentation for Into The Box 2021 on using Testbox to refactor existing code. https://forgebox.io/view/itb2021_using_testbox_to_refactor_old_code Thu, 23 Sep 2021 20:33:10 GMT projects https://forgebox.io/view/itb2021_using_testbox_to_refactor_old_code A ColdFusion CFC to manage the encoding and decoding of JWTs (JSON Web Tokens) https://forgebox.io/view/cf-jwt Wed, 11 Aug 2021 08:38:01 GMT projects https://forgebox.io/view/cf-jwt A CFWheels 2.x example app with user management, role based permissions and password resets https://forgebox.io/view/cfwheels-example-app Sun, 22 Nov 2020 10:58:29 GMT projects https://forgebox.io/view/cfwheels-example-app CFML component for encoding and decoding JSON Web Tokens (JWT) https://forgebox.io/view/cf-jwt-simple Sun, 01 Mar 2020 13:56:20 GMT projects https://forgebox.io/view/cf-jwt-simple A package for checking code quality. https://forgebox.io/view/CodeChecker Fri, 04 Oct 2019 19:49:56 GMT projects https://forgebox.io/view/CodeChecker A CFC Port of the Mobile_Detect PHP class for detecting mobile devices (including tablets). It uses the User-Agent string combined with specific HTTP headers to detect the mobile environment. https://forgebox.io/view/mobiledetect Wed, 12 Jun 2019 14:12:33 GMT projects https://forgebox.io/view/mobiledetect A Generic Application.cfc https://forgebox.io/view/application-cfc Fri, 17 Nov 2017 18:13:34 GMT projects https://forgebox.io/view/application-cfc A ColdFusion component to interact with the Bacon Ipsum API. https://forgebox.io/view/baconLipsum Wed, 15 Nov 2017 14:47:07 GMT projects https://forgebox.io/view/baconLipsum A ColdFusion component to interact with the Slack API. https://forgebox.io/view/cfslack Wed, 15 Nov 2017 13:13:47 GMT projects https://forgebox.io/view/cfslack An example fw/1 application with secure authentication and session management functions https://forgebox.io/view/fw1-sa Tue, 12 Sep 2017 13:41:30 GMT projects https://forgebox.io/view/fw1-sa A ColdFusion wrapper to interact with the brewpunk API https://forgebox.io/view/brewpunkAPI Tue, 01 Aug 2017 08:11:43 GMT projects https://forgebox.io/view/brewpunkAPI Google Calendar V3 for ColdFusion https://forgebox.io/view/CF-GoogleCal-V3 Fri, 10 Jun 2016 11:23:02 GMT projects https://forgebox.io/view/CF-GoogleCal-V3 Examples for oauth2 https://forgebox.io/view/oauth2-examples Fri, 10 Jun 2016 11:18:23 GMT projects https://forgebox.io/view/oauth2-examples ColdBox Platform Sublime IDE Package https://forgebox.io/view/ColdBox-Sublime-Text-Bundle Fri, 10 Jun 2016 10:31:18 GMT projects https://forgebox.io/view/ColdBox-Sublime-Text-Bundle Automatically autowires Reactor objects https://forgebox.io/view/Reactor-factory-with-autowire-support Fri, 10 Jun 2016 09:51:20 GMT projects https://forgebox.io/view/Reactor-factory-with-autowire-support ColdBox speaks groovy! You can script in groovy and even consume groovy classes and templates. https://forgebox.io/view/Groovy-Loader-Project Fri, 10 Jun 2016 06:23:43 GMT projects https://forgebox.io/view/Groovy-Loader-Project A set of scaffolding templates for ColdBox Applications using Illudium PU-36 https://forgebox.io/view/Illudium-Scaffolding-Templates Fri, 10 Jun 2016 05:13:50 GMT projects https://forgebox.io/view/Illudium-Scaffolding-Templates A simple wrapper around some of MailChimp's List API. https://forgebox.io/view/Mailchimp-List Fri, 10 Jun 2016 01:08:40 GMT projects https://forgebox.io/view/Mailchimp-List Partial SASS implementation written in CF https://forgebox.io/view/Half-SASS Fri, 10 Jun 2016 00:06:17 GMT projects https://forgebox.io/view/Half-SASS A set of modules to provide dynamic scaffolding to any ColdBox application leveraging Transfer ORM https://forgebox.io/view/ColdBox-Lookup-Manager Thu, 09 Jun 2016 23:15:00 GMT projects https://forgebox.io/view/ColdBox-Lookup-Manager oauth2 for Google https://forgebox.io/view/oauth2 Thu, 09 Jun 2016 23:08:43 GMT projects https://forgebox.io/view/oauth2 ColdFusion/Lucee Wrapper for MariaDB https://forgebox.io/view/cfmariadb Thu, 09 Jun 2016 13:09:39 GMT projects https://forgebox.io/view/cfmariadb An extension for ColdFusion 7, 8 & 9 Administrator that allows adding/viewing/removing of SSL certif https://forgebox.io/view/cf-certman Thu, 09 Jun 2016 04:30:05 GMT projects https://forgebox.io/view/cf-certman An extension for ColdFusion 10 Administrator that allows adding/viewing/removing of SSL certificates https://forgebox.io/view/cf10-certman Wed, 08 Jun 2016 22:14:35 GMT projects https://forgebox.io/view/cf10-certman Various Utility Methods for Security https://forgebox.io/view/securityutil Wed, 08 Jun 2016 20:02:43 GMT projects https://forgebox.io/view/securityutil Examples for CF-GoogleCal-V3 https://forgebox.io/view/CF-GoogleCal-V3-Examples Tue, 07 Jun 2016 19:19:55 GMT projects https://forgebox.io/view/CF-GoogleCal-V3-Examples