passwd

Documentation

Index

• Constants
• func Authenticate(inputPassword, storedHash string) bool
• func CheckPasswordHash(password, hash string) bool
• func HashPassword(password string) (string, error)
• func IsHashed(password string) bool

Constants

const (
	DefaultCost    = 12 // Usually 10
	MaxPasswordLen = 72 // bcrypt input limit
)

Constants for cost and max password length (bcrypt truncates after 72 bytes)

Functions

func Authenticate

func Authenticate(inputPassword, storedHash string) bool

Authenticate verifies whether the input password matches the stored bcrypt hash. Returns true if authentication is successful.

func CheckPasswordHash

func CheckPasswordHash(password, hash string) bool

CheckPasswordHash compares a plaintext password with a bcrypt hashed password. Returns true if they match, false otherwise.

func HashPassword

func HashPassword(password string) (string, error)

HashPassword hashes a password using bcrypt with the DefaultCost

func IsHashed

func IsHashed(password string) bool

IsHashed checks if a given password string appears to be a bcrypt hash. This is a simple sanity check to prevent storing plaintext passwords in the database.

It verifies two things: 1. Length: bcrypt hashes are always 60 characters long. 2. Prefix: bcrypt hashes start with "$2a$", "$2b$", or "$2y$".

Returns true if the string looks like a valid bcrypt hash, false otherwise.

Note: This check is not cryptographically guaranteed — it only validates the string format. A string could theoretically match the length and prefix without being a true bcrypt hash. However, for the purpose of preventing accidental storage of plaintext passwords, this is sufficient as a final safety check before writing to the database.