CryptoService crypto = NexAuthAPI.getInstance().getCryptoService();

// Hash password
String hashedPassword = crypto.hashPassword("myPassword123");

// Verify password
boolean matches = crypto.verifyPassword("myPassword123", hashedPassword);

if (matches) {
    // Password is correct
}

// Hash with custom cost factor (4-31, default 12)
String hashedPassword = crypto.hashPassword("password", 14);

// Higher cost = more secure but slower
// Cost 12 = ~300ms on modern hardware
// Cost 14 = ~1.2s on modern hardware

// Migrate from old hash to new hash
String oldHash = "old_algorithm_hash";
String newPassword = "userInput";

if (crypto.isLegacyHash(oldHash)) {
    // Verify with old algorithm
    if (crypto.verifyLegacy(newPassword, oldHash)) {
        // Rehash with bcrypt
        String newHash = crypto.hashPassword(newPassword);
        // Save new hash to database
    }
}

// Encrypt sensitive data
String plaintext = "sensitive data";
String encrypted = crypto.encrypt(plaintext);

// Decrypt data
String decrypted = crypto.decrypt(encrypted);

// Encrypt with custom key
String key = crypto.generateKey();
String encrypted = crypto.encrypt(plaintext, key);
String decrypted = crypto.decrypt(encrypted, key);

// Encrypt file
File inputFile = new File("data.txt");
File outputFile = new File("data.enc");
crypto.encryptFile(inputFile, outputFile);

// Decrypt file
File encryptedFile = new File("data.enc");
File decryptedFile = new File("data_decrypted.txt");
crypto.decryptFile(encryptedFile, decryptedFile);

// Generate random bytes
byte[] randomBytes = crypto.generateRandomBytes(32);

// Generate random string
String randomString = crypto.generateRandomString(16);

// Generate random password
String password = crypto.generatePassword(12, true, true, true);

// Generate TOTP secret
String secret = crypto.generateTOTPSecret();

// Generate backup codes
List<String> backupCodes = crypto.generateBackupCodes(10);

// Verify TOTP code
boolean valid = crypto.verifyTOTPCode(secret, "123456");

// SHA-256 hash
String hash = crypto.sha256("data to hash");

// SHA-512 hash
String hash = crypto.sha512("data to hash");

// MD5 hash (not recommended for security)
String hash = crypto.md5("data to hash");

// Hash file
File file = new File("data.txt");
String hash = crypto.sha256File(file);

// Derive key from password
String password = "myPassword";
byte[] salt = crypto.generateRandomBytes(16);
byte[] key = crypto.deriveKey(password, salt, 10000, 256);

// HMAC-SHA256
String hmac = crypto.hmac256("key", "message");

// HMAC-SHA512
String hmac = crypto.hmac512("key", "message");

// Create secure string (erases from memory when done)
try (SecureString secure = new SecureString("sensitive data")) {
    // Use secure string
    char[] chars = secure.getChars();
    // Process data...
} // Secure string is automatically erased

// Validate password strength
PasswordStrength strength = crypto.validatePassword("password123");

if (strength.isStrong()) {
    // Password is strong
} else {
    // Check requirements
    if (!strength.hasMinLength()) {
        // Password too short
    }
    if (!strength.hasUppercase()) {
        // Missing uppercase letter
    }
    if (!strength.hasNumbers()) {
        // Missing numbers
    }
}

// Generate strong password
String strongPassword = crypto.generateStrongPassword(16);

// Generate JWT token
String token = crypto.generateJWTToken(
    Map.of("user", "username", "exp", System.currentTimeMillis() + 3600000)
);

// Verify JWT token
boolean valid = crypto.verifyJWTToken(token);

// Decode JWT token
Map<String, Object> claims = crypto.decodeJWTToken(token);

// Generate API token
String token = crypto.generateApiToken();

// Verify API token
boolean valid = crypto.verifyApiToken(token);

// Always use bcrypt for passwords
String hashed = crypto.hashPassword(password);

// Never store plaintext passwords
// Never use MD5 or SHA-1 for passwords

// Use appropriate work factor
int costFactor = 12; // Default, good balance
int highSecurity = 14; // For admin accounts
int lowSecurity = 10; // For test environments

// Use AES-256 for data encryption
String encrypted = crypto.encrypt(sensitiveData);

// Store encryption key securely
// Never hardcode keys in source code
// Use environment variables or key management systems

// Rotate keys periodically

// Use cryptographically secure random
String random = crypto.generateRandomString(32);

// Never use Math.random() for security
// Never use java.util.Random for security

// Generate sufficient length
// Minimum 16 bytes for tokens
// Minimum 32 bytes for API keys

// Bcrypt cost factors and approximate times
// Cost 4: ~10ms
// Cost 8: ~50ms
// Cost 12: ~300ms (recommended)
// Cost 14: ~1.2s (high security)
// Cost 16: ~4.8s (very high security)

// For production use
int costFactor = 12; // Good balance of security and speed

// Async password hashing
CompletableFuture<String> future = crypto.hashPasswordAsync(password);

future.thenAccept(hashed -> {
    // Use hashed password
}).exceptionally(throwable -> {
    // Handle error
    return null;
});