I need to know the algorithm used to generate the password hashs that look like this: $2a$08$ztQUBr1vx97Rc9MiJVr05.LZWg92jGYkRFEJViHhfZjaWpB0xfgGu

It looks like bcrypt to me but when I hashed my password using a script they did not match up. So I believe something else is done to the password before storing it inside a database. Is it a salt? If so, what is it?


crypt(3) states that the $2a$ prefix indicates Blowfish. The OpenBSD crypt(3) provides some further details on the format.

If you have a glibc with Blowfish support, you can basically just call crypt() yourself, or use another program that does this. I've found makepasswd to be useful for this purpose.

To see details of the algorithm, you probably want to refer to actual source code. PHP has a version of crypt with built-in Blowfish support, which can be easily called from its interactive mode (php -a). If that doesn't work out, you probably want to dig into the ownCloud source.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.