Jon Portnoy > App-bmkpasswd-2.002000 > App::bmkpasswd



Annotate this POD

View/Report Bugs
Module Version: 2.002000   Source   Latest Release: App-bmkpasswd-2.004002


App::bmkpasswd - bcrypt-capable mkpasswd(1) and exported helpers


  ## From Perl:

  use App::bmkpasswd 'mkpasswd', 'passwdcmp';
  my $bcrypted = mkpasswd($passwd);
  say 'matched' if passwdcmp($passwd, $bcrypted);

  ## From a shell:

  bmkpasswd --help
  # Generate bcrypted passwords
  # Defaults to work cost factor '08':
  bmkpasswd --workcost='06'

  # SHA requires Crypt::Passwd::XS or glibc2.7+
  bmkpasswd --method='sha512'
  # Compare a hash:
  bmkpasswd --check=HASH

  # Check hash generation times:
  bmkpasswd --benchmark


App::bmkpasswd is a simple bcrypt-enabled mkpasswd.

Helper functions are also exported for use in other applications; see "EXPORTED". Crypt::Bcrypt::Easy provides an easier bcrypt-specific programmatic interface for Perl programmers.

See bmkpasswd --help for usage information.

Uses Crypt::Eksblowfish::Bcrypt for bcrypted passwords.

Bcrypt comes with a configurable work-cost factor; that allows hash generation to become configurably slower as computers get faster, thereby impeding brute-force hash generation attempts.

See for more on why you ought to be using bcrypt or similar "adaptive" techniques.

SHA-256 and SHA-512 are supported if available. You'll need either Crypt::Passwd::XS or a system crypt() that can handle SHA, such as glibc-2.7+ or modern FreeBSD builds.

Uses Bytes::Random::Secure to generate random salts. For the paranoid, constant time comparison is used when comparing hashes; strongly-random salts can also be enabled.


Crypt::Bcrypt::Easy provides an easier programmatic interface, if you're only interested in generating bcrypt passwords. If you'd like to make use of other password types, you can use the exported mkpasswd and passwdcmp functions:

  use App::bmkpasswd 'mkpasswd', 'passwdcmp';
  # Same as:
  use App::bmkpasswd -all;

This module uses Exporter::Tiny to export functions. This provides for flexible import options. See the Exporter::Tiny docs for details.


  ## Generate a bcrypted passwd with work-cost 08:
  $bcrypted = mkpasswd($passwd);

  ## Generate a bcrypted passwd with other work-cost:
  $bcrypted = mkpasswd($passwd, 'bcrypt', '10');

  ## SHA:
  $crypted = mkpasswd($passwd, 'sha256');
  $crypted = mkpasswd($passwd, 'sha512');

  ## Use a strongly-random salt (requires spare entropy):
  $crypted = mkpasswd($passwd, 'bcrypt', '08', 'strong');
  $crypted = mkpasswd($passwd, 'sha512', 0, 'strong');


  ## Compare a password against a hash
  ## passwdcmp() will return the hash if it is a match
  if ( passwdcmp($plaintext, $crypted) ) {
    ## Successful match
  } else {
    ## Failed match


There is currently no easy way to pass your own salt; frankly, this thing is aimed at some projects of mine where that issue is unlikely to come up and randomized is appropriate. If that's a problem, patches welcome? ;-)


Jon Portnoy <>

syntax highlighting: