10

I'm writing a unit test that says that user passwords should be hashed using bcrypt. To assert this I need to be able to check if a string looks like a bcrypt hash.

I can't find a function that tells me what hashing algorithm was used on a string, is there another way to do it other than something like regular expressions?

1
  • I would just create a user with password "demo" and then check if the users password is 61 chars long
    – JimL
    Commented Oct 19, 2014 at 1:29

1 Answer 1

9

@JimL soultion is a bit limiting, there is a question breaking down the structure of a bcrypt hash.

$2a$[Cost]$[Base64Salt][Base64Hash]

So depending on your application you can assert the bcrypt identifier $2a and the require costs of the generated hash.

See: https://stackoverflow.com/a/10933491/1722719 for full breakdown.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.