4

Firebase offers 'Simple Login' in which email/password is used for authentication. Does anyone know if firebase salts and hashes the password before storing it? I imagine that firebase would know enough to do so, but I just wanted to make sure, because I could not find anything on this after an hour of searching.

Anticipated follow up: If firebase in fact does not salt+hash the passwords, would the Simple Login work if I took the user's password, salted+hashed, and passed it onto firebase to store/check?

Thanks in advance!

user3916009
  • 193
  • 1
  • 8
  • 1
    According to this page (https://www.firebase.com/docs/web/guide/simple-login/password.html) Firebase uses bcrypt. According to the wikipage on bcrypt (http://en.wikipedia.org/wiki/Bcrypt), it both hashes and uses salt with that. – Frank van Puffelen Aug 06 '14 at 22:14
  • @FrankvanPuffelen Perfect! Thank you so much! I should've read more carefully instead of skimming through and searching. If you'd post it as an answer I would've selected it? – user3916009 Aug 07 '14 at 04:36

1 Answers1

8

As of 2016

As of 2016, Firebase uses a modified version of scrypt to encrypt passwords. A library to perform the encryption was released on GitHub here.

It uses both salt and hashes as shown in the sample:

# Params from the project's password hash parameters
base64_signer_key="jxspr8Ki0RYycVU8zykbdLGjFQ3McFUH0uiiTvC8pVMXAn210wjLNmdZJzxUECKbm0QsEmYUSDzZvpjeJ9WmXA=="
base64_salt_separator="Bw=="
rounds=8
memcost=14

# Params from the exported account
base64_salt="42xEC+ixf3L2lw=="

# The users raw text password
password="user1password"

# Generate the hash
# Expected output:
# lSrfV15cpx95/sZS2W9c9Kp6i/LVgQNDNC/qzrCnh1SAyZvqmZqAjTdn3aoItz+VHjoZilo78198JAdRuid5lQ==
echo `./scrypt "$base64_signer_key" "$base64_salt" "$base64_salt_separator" "$rounds" "$memcost" -P <<< "$password"`

Pre-2016

According to this page (http://firebase.com/docs/web/guide/simple-login/password.html) Firebase uses bcrypt.

According to the wiki page on bcrypt (http://en.wikipedia.org/wiki/Bcrypt), it both hashes and uses salt with that.

Kato
  • 40,352
  • 6
  • 119
  • 149
Frank van Puffelen
  • 565,676
  • 79
  • 828
  • 807