8

I'm writing a unit test that says that user passwords should be hashed using bcrypt. To assert this I need to be able to check if a string looks like a bcrypt hash.

I can't find a function that tells me what hashing algorithm was used on a string, is there another way to do it other than something like regular expressions?

John Dorean
  • 3,744
  • 9
  • 51
  • 82
  • I would just create a user with password "demo" and then check if the users password is 61 chars long – JimL Oct 19 '14 at 01:29

1 Answers1

8

@JimL soultion is a bit limiting, there is a question breaking down the structure of a bcrypt hash.

$2a$[Cost]$[Base64Salt][Base64Hash]

So depending on your application you can assert the bcrypt identifier $2a and the require costs of the generated hash.

See: https://stackoverflow.com/a/10933491/1722719 for full breakdown.

Community
  • 1
  • 1
jzahedieh
  • 1,570
  • 1
  • 15
  • 27