---
title: "locker.password-slot@1 · OpenVibe.Services"
canonical: "https://openvibe.services/docs/contracts/locker.password-slot"
updated: null
---

# locker.password-slot@1 · OpenVibe.Services

HTML: [locker.password-slot@1 · OpenVibe.Services](https://openvibe.services/docs/contracts/locker.password-slot)

# LockerPasswordSlot `locker.password-slot@1`

Generated at 2026-11-13 06:25:48 UTC from [`openvibe-contracts v0.419.0`](https://github.com/OpenVibers/OpenVibe.Contracts/tree/v0.419.0) and [`openvibe-sdk v0.161.0`](https://github.com/OpenVibers/OpenVibe.SDK/tree/v0.161.0).

- Version: 1.0.0
- Owner: network
- Visibility: public
- Status: active
- Compatibility: backward
- Schema: [`https://openvibe.network/contracts/locker/password-slot.v1.json`](/docs/contracts/locker.password-slot.json)

locker.password-slot@1: the content key wrapped with a password. The wrapping key comes from PBKDF2-SHA-256 with the salt and the iteration count in this slot, so both can be raised later without changing the format. The tag covers the parameters, so they cannot be weakened in transit.

## Fields

| Field | Type | Required | Description | Constraints |
| --- | --- | --- | --- | --- |
| `algorithm` | const | yes |  | - `= "PBKDF2-SHA256/AES-256-GCM"` |
| `kdf` | const | yes |  | - `= "PBKDF2-SHA-256"` |
| `iterations` | integer | yes | PBKDF2 iterations. 600000 is the floor for this version; the count may go up, never down. | - `minimum 600000`<br>- `maximum 10000000` |
| `salt` | string | yes | Sixteen random bytes, base64: the PBKDF2 salt. | - `pattern ^[A-Za-z0-9+/]{22}==$` |
| `nonce` | string | yes | Twelve random bytes, base64: the AES-GCM nonce of the wrapped content key. | - `pattern ^[A-Za-z0-9+/]{16}$` |
| `wrapped_key` | string | yes | The 32-byte content key and its 16-byte tag, base64. Never the key itself. | - `pattern ^[A-Za-z0-9+/]{64}$` |

## Examples

From the contract's own test fixtures: valid ones validate, rejected ones must fail.

 Valid: example

~~~~
{
  "algorithm": "PBKDF2-SHA256/AES-256-GCM",
  "kdf": "PBKDF2-SHA-256",
  "iterations": 600000,
  "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",
  "nonce": "bm5ubm5ubm5ubm5u",
  "wrapped_key": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
}
~~~~

Rejected: weak-iterations

~~~~
{
  "algorithm": "PBKDF2-SHA256/AES-256-GCM",
  "kdf": "PBKDF2-SHA-256",
  "iterations": 1000,
  "salt": "c3Nzc3Nzc3Nzc3Nzc3Nzcw==",
  "nonce": "bm5ubm5ubm5ubm5u",
  "wrapped_key": "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
}
~~~~

## Validate

~~~~
const contracts = require('openvibe-contracts');
contracts.validate('locker.password-slot@1', value);   // { valid, errors: [{ path, message }] }
~~~~