> Was hoping to avoid a 'heavy' dependency like OpenSSL, but that seems to > be most the libs out there. There is also MBedTLS (https://tls.mbed.org/openssl-alternative), which is a bit smaller and can be configured to give you the libraries you need. Argon2 (https://en.wikipedia.org/wiki/Argon2) is a more modern bcrypt and both Argon2 and MBedTLS have lua bindings. Paul.