diff --git a/materialious/src/lib/backend.ts b/materialious/src/lib/backend.ts
index 9a5052d0..ec96cad3 100644
--- a/materialious/src/lib/backend.ts
+++ b/materialious/src/lib/backend.ts
@@ -1,3 +1,5 @@
+import sodium from 'libsodium-wrappers-sumo';
+
 export type IsOwnBackend = {
 	builtWithBackend: boolean;
 	internalAuth: boolean;
@@ -16,4 +18,39 @@ export function isOwnBackend(): IsOwnBackend | null {
 	};
 }
 
-async function backendLogin(username: string, password: string) {}
+export async function backendLogin(username: string, rawPassword: string) {
+	await sodium.ready;
+
+	const passwordSaltsResp = await fetch(`/api/user/${username}/public`);
+	if (!passwordSaltsResp.ok) return;
+
+	const passwordSalts = await passwordSaltsResp.json();
+
+	const loginHash = sodium.crypto_pwhash(
+		32,
+		rawPassword,
+		sodium.from_base64(passwordSalts.passwordSalt),
+		sodium.crypto_pwhash_OPSLIMIT_SENSITIVE,
+		sodium.crypto_pwhash_MEMLIMIT_SENSITIVE,
+		sodium.crypto_pwhash_ALG_DEFAULT
+	);
+
+	const loginResp = await fetch('/api/user/login', {
+		method: 'POST',
+		body: JSON.stringify({
+			username,
+			passwordHash: loginHash
+		})
+	});
+
+	if (!loginResp.ok) return;
+
+	const subscriptionRawKey = sodium.crypto_pwhash(
+		32,
+		rawPassword,
+		sodium.from_base64(passwordSalts.subscriptionPasswordSalt),
+		sodium.crypto_pwhash_OPSLIMIT_INTERACTIVE,
+		sodium.crypto_pwhash_MEMLIMIT_INTERACTIVE,
+		sodium.crypto_pwhash_ALG_DEFAULT
+	);
+}
diff --git a/materialious/src/routes/api/user/[userId]/public/+server.ts b/materialious/src/routes/api/user/[userId]/public/+server.ts
index d4e5e958..f8287bcf 100644
--- a/materialious/src/routes/api/user/[userId]/public/+server.ts
+++ b/materialious/src/routes/api/user/[userId]/public/+server.ts
@@ -1,7 +1,7 @@
 import { getUser } from '$lib/backendOnly/user';
 import { json } from '@sveltejs/kit';
 
-export async function GET({ locals }) {
-	const user = await getUser(locals.userId);
+export async function GET({ params }) {
+	const user = await getUser(params.userId);
 	return json(user.publicPasswordSalts);
 }