Hachage un mot de passe et vérifier it later sans storing le plaintext
Utiliser un lent mot de passe-hashing fonction (bcrypt/PBKDF2/scrypt) en stocker un salted hachage, puis vérifier un candidate mot de passe against it.
- 1
Never store passwords in plaintext or with fast hashes (MD5/SHA-256) — they are trivially brute-forced. Use a slow, salted KDF (bcrypt, scrypt, PBKDF2) that deliberately costs CPU/memory per attempt, making bulk cracking infeasible.
- 2 Générateur de hash bcrypt →
Enter the password and a cost factor (10-12 for interactive, 12-14 for sensitive). The tool outputs a self-describing hash containing the algorithm, cost, salt, and digest.
- 3 Comparateur de hash →
To verify: enter the candidate password and the stored bcrypt hash. The tool re-hashes with the embedded salt and cost and compares in constant time — returns true/false without revealing timing information.
- 4 hash → crc32
Use the hash-and-verify chain to test the full lifecycle: hash a password, then verify a correct and an incorrect candidate in one pass.
Questions fréquentes
- Why can't I use SHA-256 for password hashing?
- SHA-256 is fast — a GPU can compute billions per second. bcrypt/scrypt are deliberately slow and memory-hard, making each guess cost milliseconds. This asymmetry is what protects slow hashes against offline brute force.
- What cost factor should I choose?
- Choose the highest cost that still meets your latency budget. For bcrypt, cost 10 takes ~100ms, cost 12 ~400ms, cost 14 ~1.6s. Increase the cost as hardware speeds up — the hash embeds the cost so old hashes still verify.