Class: BCrypt::Password

### Home Classes Methods

### In Files

- lib/bcrypt/password.rb

### Parent

String

### Methods

- ::create
- ::new
- ::valid_hash?
- #==
- #is_password?

### Files

- CHANGELOG
- COPYING

### Class/Module Index

Quicksearch

- BCrypt
- BCrypt::Engine
- BCrypt::Errors
- BCrypt::Errors::InvalidCost
- BCrypt::Errors::InvalidHash
- BCrypt::Errors::InvalidSalt
- BCrypt::Errors::InvalidSecret
- BCrypt::Password

No matching classes.

# BCrypt::Password

A password management class which allows you to safely store users' passwords and compare them.

Example usage:

    include BCrypt

    # hash a user's password
    @password = Password.create("my grand secret")
    @password #=> "$2a$10$GtKs1Kbsig8ULHZzO1h2TetZfhO4Fmlxphp8bVKnUlZCBYYClPohG"

    # store it safely
    @user.update_attribute(:password, @password)

    # read it back
    @user.reload!
    @db_password = Password.new(@user.password)

    # compare it after retrieval
    @db_password == "my grand secret" #=> true
    @db_password == "a paltry guess"  #=> false

### Attributes

checksum[R]

The hash portion of the stored password hash.

cost[R]

The cost factor used to create the hash.

salt[R]

The salt of the store password hash (including version and cost).

version[R]

The version of the bcrypt() algorithm used to create the hash.

### Public Class Methods

create(secret, options = {}) click to toggle source

Hashes a secret, returning a BCrypt::Password instance. Takes an optional `:cost` option, which is a logarithmic variable which determines how computational expensive the hash is to calculate (a `:cost` of 4 is twice as much work as a `:cost` of 3). The higher the `:cost` the harder it becomes for attackers to try to guess passwords (even if a copy of your database is stolen), but the slower it is to check users' passwords.

Example:

    @password = BCrypt::Password.create("my secret", :cost => 13)

    # File lib/bcrypt/password.rb, line 43
    def create(secret, options = {})
      cost = options[:cost] || BCrypt::Engine.cost
      raise ArgumentError if cost > 31
      Password.new(BCrypt::Engine.hash_secret(secret, BCrypt::Engine.generate_salt(cost)))
    end

new(raw_hash) click to toggle source

Initializes a BCrypt::Password instance with the data from a stored hash.

    # File lib/bcrypt/password.rb, line 55
    def initialize(raw_hash)
      if valid_hash?(raw_hash)
        self.replace(raw_hash)
        @version, @cost, @salt, @checksum = split_hash(self)
      else
        raise Errors::InvalidHash.new("invalid hash")
      end
    end

valid_hash?(h) click to toggle source

    # File lib/bcrypt/password.rb, line 49
    def valid_hash?(h)
      h =~ /^\$[0-9a-z]{2}\$[0-9]{2}\$[A-Za-z0-9\.\/]{53}$/
    end

### Public Instance Methods

==(secret) click to toggle source

Compares a potential secret against the hash. Returns true if the secret is the original secret, false otherwise.

    # File lib/bcrypt/password.rb, line 65
    def ==(secret)
      super(BCrypt::Engine.hash_secret(secret, @salt))
    end

Also aliased as: is_password?
is_password?(secret) click to toggle source
Alias for: ==

[Validate]

Generated with the Darkfish Rdoc Generator 2.