bcrypthash

Command-line tool that reads a password with hidden terminal input and prints its bcrypt hash. Every invocation generates a fresh random salt; the default cost is 10.

Built with golang.org/x/crypto/bcrypt.

Install

go install github.com/dark/bcrypthash@latest

Usage

Hash a password (prompted twice, input hidden):

bcrypthash
bcrypthash -c 12      # custom cost, 4-31

Verify a typed password against an existing hash:

bcrypthash -v '$2a$10$...'

Verify mode reports the cost recorded in the hash and whether the typed password matches.

Exit codes

• 0: success, or password matches in verify mode
• 1: password does not match the given hash (verify mode)
• 2: usage error, invalid cost, unreadable input, or invalid hash

Notes

• The hash goes to stdout; prompts and status go to stderr, so the hash can be captured cleanly: hash=$(bcrypthash).
• A cost below 4 is rejected rather than silently replaced by the default (the bcrypt library would bump it to 10 otherwise).