diff --git a/extra/sodium/ffi/ffi.factor b/extra/sodium/ffi/ffi.factor
index 0ee57c9f5b..3017535eea 100644
--- a/extra/sodium/ffi/ffi.factor
+++ b/extra/sodium/ffi/ffi.factor
@@ -19,3 +19,29 @@ FUNCTION: void randombytes_buf ( void* buf, size_t size )
 FUNCTION: uint32_t randombytes_random ( )
 FUNCTION: uint32_t randombytes_uniform ( uint32_t upper_bound )
 FUNCTION: void randombytes_stir ( )
+
+! crypto_pwhash_H
+FUNCTION: int crypto_pwhash_alg_argon2i13 ( )
+FUNCTION: int crypto_pwhash_alg_default ( )
+FUNCTION: size_t crypto_pwhash_saltbytes ( )
+FUNCTION: size_t crypto_pwhash_strbytes ( )
+FUNCTION: char* crypto_pwhash_strprefix ( )
+FUNCTION: size_t crypto_pwhash_opslimit_interactive ( )
+FUNCTION: size_t crypto_pwhash_memlimit_interactive ( )
+FUNCTION: size_t crypto_pwhash_opslimit_moderate ( )
+FUNCTION: size_t crypto_pwhash_memlimit_moderate ( )
+FUNCTION: size_t crypto_pwhash_opslimit_sensitive ( )
+FUNCTION: size_t crypto_pwhash_memlimit_sensitive ( )
+FUNCTION: int crypto_pwhash (
+    uchar* out, ulonglong outlen,
+    char* passwd, ulonglong passwdlen,
+    uchar* salt,
+    ulonglong opslimit, size_t memlimit, int alg )
+FUNCTION: int crypto_pwhash_str (
+    char* out[crypto_pwhash_STRBYTES],
+    char* passwd, ulonglong passwdlen,
+    ulonglong opslimit, size_t memlimit )
+FUNCTION: int crypto_pwhash_str_verify (
+    char* str[crypto_pwhash_STRBYTES],
+    char* passwd, ulonglong passwdlen )
+FUNCTION: char* crypto_pwhash_primitive ( )
diff --git a/extra/sodium/sodium.factor b/extra/sodium/sodium.factor
index 98df73f70a..a495f5d117 100644
--- a/extra/sodium/sodium.factor
+++ b/extra/sodium/sodium.factor
@@ -1,9 +1,11 @@
 ! Copyright (C) 2017 Alexander Ilin.
 ! See http://factorcode.org/license.txt for BSD license.
-USING: init kernel math sequences sodium.ffi ;
+USING: byte-arrays init io.encodings.string io.encodings.utf8
+kernel math sequences sodium.ffi ;
 IN: sodium
 
 ERROR: sodium-init-fail ;
+ERROR: call-fail ;
 
 ! Call this before any other function, may be called multiple times.
 : sodium-init ( -- ) sodium_init 0 < [ sodium-init-fail ] when ;
@@ -11,4 +13,17 @@ ERROR: sodium-init-fail ;
 : random-bytes ( byte-array -- byte-array' )
     dup dup length randombytes_buf ;
 
+: n-random-bytes ( n -- byte-array )
+    <byte-array> random-bytes ;
+
+: check0 ( n -- ) 0 = [ call-fail ] unless ;
+
+: crypto-pwhash-str ( password opslimit memlimit -- str )
+    [ crypto_pwhash_strbytes <byte-array> dup ] 3dip
+    [ utf8 encode dup length ] 2dip crypto_pwhash_str check0
+    utf8 decode ;
+
+: crypto-pwhash-str-verify ( str password -- bool )
+    [ utf8 encode ] bi@ dup length crypto_pwhash_str_verify 0 = ;
+
 [ sodium-init ] "sodium" add-startup-hook