No need to use an additional variable just to compose the salted pass.

JSON doesn't make any sense in this case.

dudeswave/src/dudeswave_user_handler.erl

@@ -13,7 +13,7 @@
 % ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 % OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 %
--module(dudeswave_register_handler).
+-module(dudeswave_user_handler).
 -moduledoc """
 Register a new user.
 """.
@@ -53,17 +53,14 @@ known_methods(Req, State) ->
 resource_exists(Req, State) ->
 	{ok, Bucket} = maps:find(bucket, State),
 
-	case cowboy:read_body(Req, #{period => 5000, length => 8192}) of
+	case cowboy:read_urlencoded_body(Req) of
-		{ok, Body, NewReq} ->
+		{ok, [{name, Name}, {username, User}, {password, Password}], NewReq} ->
-			#{<<"name">> := Name, <<"password">> := Pass,
-			    <<"user">> := User} = json:decode(Body),
-
 			case storage:read(Bucket, User) of
 				{ok, [_R]} ->
 					{true, NewReq, user_exists};
 				{ok, []} ->
 					{false, NewReq, {Bucket, [{name, Name},
-					    {username, User},{password, Pass}]}}
+					    {username, User},{password, Password}]}}
 			end
 	end.
 
@@ -73,8 +70,7 @@ is_conflict(Req, State) -> {false, Req, State}.
 
 create_user(Req, {Bucket, [{name, Name}, {username, User}, {password, Pass}]}) ->
 	Salt = rand:bytes(32),
-	SaltedPW = <<Pass/binary, Salt/binary>>,
+	Hash = crypto:hash(sha256, <<Pass/binary, Salt/binary>>),
-	Hash = crypto:hash(sha256, SaltedPW),
 
 	case storage:write(Bucket, User, Hash, [{salt, Salt}, {name, Name}]) of
 		ok ->