Verify a plaintext password against a hash produced by hashPassword.
The stored parameters and salt are read back from stored, the candidate is
re-derived with them, and the two keys are compared with timingSafeEqual to
avoid leaking information through comparison timing. Any structurally invalid or
non-scrypt stored value (empty string, wrong field count, unknown algorithm,
bad hex) yields false rather than throwing, so it is safe on an auth path.
Verify a plaintext password against a hash produced by hashPassword.
The stored parameters and salt are read back from
stored, the candidate is re-derived with them, and the two keys are compared withtimingSafeEqualto avoid leaking information through comparison timing. Any structurally invalid or non-scryptstoredvalue (empty string, wrong field count, unknown algorithm, bad hex) yieldsfalserather than throwing, so it is safe on an auth path.