GET_PASSWORD_HASH / VERIFY_PASSWORD_HASH slow down the server thread

[Korioz]

What happened?

Password hash natives uses bcrypt under the hood, bcrypt is designed to be slow the issue is not that it is slow, the issue is that calling password hashing natives will make the server thread hitch during the operations.

Maybe providing async alternatives natives and executing bcrypt operations in another thread would be a viable solution.

Expected result

No server thread hitch.

Reproduction steps

1. Execute a server-side script containing this :

RegisterCommand('testpass', function()
    local pass = 'MyVeryStrongPassword123'
    
    local timeNow = GetGameTimer()
    local passHash = GetPasswordHash(pass)
    VerifyPasswordHash(pass, passHash)
    print(('%u ms elapsed during password operations'):format(GetGameTimer() - timeNow))
end, false)

2. Type testpass in Console and see the output.

Importancy

Slight inconvenience

Area(s)

FXServer, Natives

Specific version(s)

Tested on Server 8867 and olders (this issue has been here for years)

Additional information

No response

[FILIP-P-K]

just use

local function getPasswordHash(pass)
    return joaat(pass)
end

local function verifyPasswordHash(pass, hash)
    return getPasswordHash(pass) == hash
end

[CrunchyBadger]

@Korioz This is a hack workaround till its fixed if you need it. https://github.com/CrunchyBadger/fivem-bcrypt-async

(Will probably break with different fx server versions, ik it doesn't work on 8981)

Working on latest.

Works same as natives but you need to use exports.

[aioeieoiao]

Test:

Citizen.CreateThread(function()
    local password = '123123'
    local hash = GetPasswordHash(password)

    print('--- Starting VerifyPasswordHash test ---')

    local iterations = 10

    local startTime = os.clock()

    for i = 1, iterations do
        local ok = VerifyPasswordHash(password, hash)
        print(('[%d/%d] Check returned %s'):format(i, iterations, tostring(ok)))
    end

    local endTime = os.clock()
    local durationMs = (endTime - startTime) * 1000

    print(('--- Completed %d checks in %.2f ms (%.2f ms per check) ---'):format(iterations, durationMs, durationMs / iterations))
end)

Result:

[      script:test] --- Completed 10 checks in 1661.00 ms (166.10 ms per check) ---
[ citizen-server-impl] server thread hitch warning: timer interval of 1887 milliseconds

These native methods (GetPasswordHash / VerifyPasswordHash) clearly need improvement. Either they should be optimized for speed, or executed in a separate thread to avoid blocking the main server loop. Currently, each password verification can take over 100ms, which is unacceptable for high player concurrency.

[aioeieoiao]

@FabianTerhorst Have you made any progress on solving the issue?

[DaniGP17]

I can implement the async methods if that's what's required

[Korioz]

Yes async execution in another thread or such.

[FabianTerhorst]

@FabianTerhorst Have you made any progress on solving the issue?

Have you tried using node22 together with https://github.com/citizenfx/node-rebuild ?

Make sure to specify the correct node version that is used in the command line options.

[aioeieoiao]

@FabianTerhorst Have you made any progress on solving the issue?

Have you tried using node22 together with https://github.com/citizenfx/node-rebuild ?

Make sure to specify the correct node version that is used in the command line options.

I used Lua