How are passwords stored?
Passwords are not (or at least should not be) stored using encryption. They should be stored using a hashing algorithm. So if you are trying to decrypt it to recover the original password, then that isn't going to work.
Here are some links to read about how password storage works:
- https://crackstation.net/hashing-security.htm#normalhashing
- https://en.wikipedia.org/wiki/Cryptographic_hash_function#Password_verification
- and a much, much longer one here: https://security.blogoverflow.com/2013/09/about-secure-password-hashing/
How to figure out which hash algorithm was used?
Let's break down your sample password:
(This section is completely quoted from A. Hersean answer below. Please scroll down and give them an upvote)
According to wikipedia and the passlib documentation we can deduce :
- "$" is a separator
- "2a" means that the algorithm used is bcrypt with the blowfish hashing function;
- "08" is the cost parameter, i.e. 2^8 rounds;
- "9eaKUtKdFV8fuOAx0sfr4e" is the 128 bit salt encoded in Radix64;
- "mrG1aHzGeNsn/rVdW243nw6Ktt.Uc0O" is the hash encoded in Radix64.
Even knowing that it's a hash and not encryption, it's still hard to reverse-engineer which hash algorithm was used (this is by design).
Let's break down your sample password:
$2a$08$9eaKUtKdFV8fuOAx0sfr4emrG1aHzGeNsn/rVdW243nw6Ktt.Uc0O
That looks like it's broken up into three parts:
$2a $08
Probably a code identifying what type of hash was used. If you know which application generated the hash, you might be able to look this up.
$9eaKUtKdFV8fuOAx0sfr4emrG1aHzGeNsn/rVdW243nw6Ktt
This is probably the hash itself.
.Uc0O
This is probably the salt used during hashing.
Tools to identify hash type
If you google for "hash identifier tools", you'll find plenty of free websites. Personally, I like the linux command-line tool hash-identifier (in Kali, or hashid in Ubuntu):
~ hashid
$2a$08$9eaKUtKdFV8fuOAx0sfr4emrG1aHzGeNsn/rVdW243nw6Ktt.Uc0O
Analyzing '$2a$08$9eaKUtKdFV8fuOAx0sfr4emrG1aHzGeNsn/rVdW243nw6Ktt.Uc0O'
[+] Blowfish(OpenBSD)
[+] Woltlab Burning Board 4.x
[+] bcrypt
I hope this has been helpful!