What if an attacker know that I am using this library?

As we know, the hash method is returning a JSON string which contains: hash, salt, keyLength, hashMethod, iterations. Now, without knowing how an app using this library is hashing passwords, the attacker will have no way/will be slowed down when trying(?) to crack the passwords, but what if he/she knows that I am using credential library (and also its version)?

If you don’t mind another question, how would you go about rehashing users passwords with more cycles? https://github.com/ericelliott/credential/issues/23#issuecomment-83959967

[ericelliott]

Closing all stale issues and PRs. Please update, ensure all tests pass, and reopen if you really want this in.

[tjconcept]

What you’re referring to is a “pepper”, and yes, it may give you some additional security in the specific scenario where your database is compromised but your application is not. If you want to do this, it is as simple as appending your pepper before handing it to the hash method.

There are more in-depth answers here: http://security.stackexchange.com/questions/3272/password-hashing-add-salt-pepper-or-is-salt-enough