Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What's the command line to generate a blowfish password hash? I can't seem to figure this out at all. Apache's htpasswd only supports bcrypt, and openssl passwd doesn't even do blowfish hahes (but it does do blowfish encryptions with openssl enc).

Most sites point me to using $2a$ which is bcrypt, not blowfish ($2y$). Also a lot of places seem to confuse blowfish password hashing with blowfish file encryption. There are a lot of online sites which will generate blowfish hash for you, but I don't want to use an untrusted third party.

What other secure linux tools can I use to generate a blowfish password hash? I want to be able to define the two digit cost parameter as well as the salt.

share|improve this question
You want bcrypt (sometimes called CRYPT_BLOWFISH) which is a password hash not blowfish which is a block cipher. – CodesInChaos Jul 12 '13 at 14:40
up vote 2 down vote accepted

bcrypt is based on blowfish. The difference between $2a$ and $2y$ is something else:

There are multiple implementations of bcrypt. And one of them, called crypt_blowfish, had a security related bug, drastically reducing the actual password space. Fixing this bug, however, caused existing bcrypt hashes to not match the passwords anymore. So this implementation started to use $2y$ to identify the fixed implementation, while still being able to maintain compatibility.

$2a$ of the original unix implementation and $2y$ of crypt_blowfish are identical.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.