# Security infrastructure

Password hashing uses PBKDF2-HMAC-SHA256 via `package:cryptography`, with a
random per-password salt and encoded parameters in the stored hash.

API tokens are opaque random base64url strings generated with `Random.secure()`.
Only the SHA-256 hash of a token is persisted.