Compute bcrypt hash from command line

Question

I would like to compute the bcrypt hash of my password.

Is there an open source command line tool that would do that ?

I would use this hash in the Syncthing configuration file (even if I know from here that I can reset the password by editing the config file to remove the user and password in the gui section, then restart Syncthing).

Answer 1

You can (ab)use htpasswd from apache-utils package, provided you have version 2.4 or higher.

htpasswd -bnBC 10 "" password | tr -d ':\n'

-b takes the password from the second command argument
-n prints the hash to stdout instead of writing it to a file
-B instructs to use bcrypt
-C 10 sets the bcrypt cost to 10

The bare htpasswd command outputs in format <name>:<hash> followed by two newlines. Hence the empty string for name and tr stripping the colon and newlines.

The command outputs bcrypt with $2y$ prefix, which may be problem for some uses, but can easily be fixed by another sed since the OpenBSD variant using $2a$ is compatible with the fixed crypt_blowfish variant using $2y$.

htpasswd -bnBC 10 "" password | tr -d ':\n' | sed 's/$2y/$2a/'

Link to htpasswd man page: https://httpd.apache.org/docs/2.4/programs/htpasswd.html
Details about bcrypt variants: https://stackoverflow.com/a/36225192/6732096

Answer 2

You can use a Python library. On my Fedora system I did:

sudo dnf search bcrypt

(the sudo is just to avoid wasting space for a user dnf cache) and from the result can see there is a Python2 and Python3 package:

py-bcrypt.x86_64 : Python bindings for OpenBSD's Blowfish password hashing code
python3-py-bcrypt.x86_64 : Python 3 bindings for OpenBSD's Blowfish password hashing code

Install the Python2 version and list the files in the package:

sudo dnf install py-bcrypt.x86_64
rpm -ql py-bcrypt.x86_64

This shows there is a file /usr/lib64/python2.7/site-packages/bcrypt/__init__.py so I can get the documentation with

pydoc bcrypt

This shows me enough to write the following command which will hash the string "password":

$ python -c 'import bcrypt; print(bcrypt.hashpw("password", bcrypt.gensalt(log_rounds=10)))'
$2a$10$vWFRZgbOx6RKOKYxCTtyWuMJM60E90Vdm/.0nj.X/o3dYUxvQ/2Dm

For later versions of bcrypt use rounds= instead of log_rounds=.

Answer 3

This is relevant for FreeBSD, since htpasswd isn't available without installing apache. Building on @meuh's answer, here's how to use Python3 in FreeBSD to get a bcrypt hash of a password - for example, for basic auth in a traefik jail.

Note the following assumes a jail. Be careful with pip if this is the base OS. Adjust for version of Python3 depending on FreeBSD version and current Python3 versions available on it.

pkg install py37-pip
pip install bcrypt

And run, again adjusting for Python 3 version:

python3.7 -c 'import bcrypt; print(bcrypt.hashpw(b"PASSWORD", bcrypt.gensalt(rounds=15)).decode("ascii"))'

@Stuart Cardall rightly points out that this lands your password in history. "Left to the reader" to take this Python3 snippet and expand by a prompt for username and password, so that this information doesn't end up in ps or history.

Answer 4

Additional to @Disassembler's answer:

• it's not a good idea to pass passwords in from the command line (as the password could be viewable with ps)
• 15 is a good balance for complexity / password generation speed

Wrapper script for htpasswd & bcrypt:

#!/bin/sh

## bcrypt passwd generator ##
#############################
CMD=$(which htpasswd 2>/dev/null)
OPTS="-nBC 15"
USERNAME=$1

usage() {
        local script=$(basename $0)
        cat <<EOF
$script: Generate Bcrypt Hashed Passwords using htpasswd

Usage: $script username
EOF
        exit 1
}

check_config() {
    if [ -z $CMD ]; then
        printf "Exiting: htpasswd is missing.\n"
        exit 1
    fi

    if [ -z "$USERNAME" ]; then
            usage
    fi
}

check_config $USERNAME
printf "Generating Bcrypt hash for username: $USERNAME\n\n"
$CMD $OPTS $USERNAME
exit $?