What's the command line to generate a blowfish password hash? I can't seem to figure this out at all. Apache's htpasswd only supports bcrypt, and openssl passwd doesn't even do blowfish hahes (but it does do blowfish encryptions with openssl enc).

Most sites point me to using $2a$ which is bcrypt, not blowfish ($2y$). Also a lot of places seem to confuse blowfish password hashing with blowfish file encryption. There are a lot of online sites which will generate blowfish hash for you, but I don't want to use an untrusted third party.

What other secure linux tools can I use to generate a blowfish password hash? I want to be able to define the two digit cost parameter as well as the salt.

  • You want bcrypt (sometimes called CRYPT_BLOWFISH) which is a password hash not blowfish which is a block cipher. Jul 12, 2013 at 14:40

1 Answer 1


bcrypt is based on blowfish. The difference between $2a$ and $2y$ is something else:

There are multiple implementations of bcrypt. And one of them, called crypt_blowfish, had a security related bug, drastically reducing the actual password space. Fixing this bug, however, caused existing bcrypt hashes to not match the passwords anymore. So this implementation started to use $2y$ to identify the fixed implementation, while still being able to maintain compatibility.

$2a$ of the original unix implementation and $2y$ of crypt_blowfish are identical.

  • 2
    What about the basic intention of this thread? How to generate ... in Ubuntu? (though any other Linux flavour might be fine as well) As a best match on search engines this thread is pretty unsolved regarding to that point of the issue. Apr 17, 2017 at 7:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .