Data.Password.Bcrypt

Phantom type for bcrypt

A plain-text password.

This represents a plain-text password that has NOT been hashed.

You should be careful with Password. Make sure not to write it to logs or store it in a database.

You can construct a Password by using the mkPassword function or as literal strings together with the OverloadedStrings pragma (or manually, by using fromString on a String). Alternatively, you could also use some of the instances in the password-instances library.

Construct a Password

Hash the Password using the bcrypt hash algorithm.

N.B.: bcrypt has a limit of 72 bytes as input, so anything longer than that will be cut off at the 72 byte point and thus any password that is 72 bytes or longer will match as long as the first 72 bytes are the same.

>>> hashPassword $ mkPassword "foobar"PasswordHash {unPasswordHash = "$2b$10$..."}

A hashed password.

This represents a password that has been put through a hashing function. The hashed password can be stored in a database.

Check a Password against a PasswordHash Bcrypt.

Returns PasswordCheckSuccess on success.

>>> let pass = mkPassword "foobar">>> passHash <- hashPassword pass>>> checkPassword pass passHashPasswordCheckSuccess

Returns PasswordCheckFail if an incorrect Password or PasswordHash Bcrypt is used.

>>> let badpass = mkPassword "incorrect-password">>> checkPassword badpass passHashPasswordCheckFail

This should always fail if an incorrect password is given.

prop> \(Blind badpass) -> let correctPasswordHash = hashPasswordWithSalt 8 salt "foobar" in checkPassword badpass correctPasswordHash == PasswordCheckFail

The result of checking a password against a hashed version. This is returned by the checkPassword functions.

Hash a password using the bcrypt algorithm with the given cost.

The higher the cost, the longer hashPassword and checkPassword will take to run, thus increasing the security, but taking longer and taking up more resources. The optimal cost for generic user logins would be one that would take between 0.05 - 0.5 seconds to check on the machine that will run it.

N.B.: It is advised to use hashPassword if you're unsure about the implications that changing the cost brings with it.

Default parameters for the Bcrypt algorithm.

>>> defaultParams10

Extracts the cost parameter as an Int from a PasswordHash Bcrypt

>>> let pass = mkPassword "foobar">>> passHash <- hashPassword pass>>> extractParams passHash == Just 10True

This is an unsafe function that shows a password in plain-text.

>>> unsafeShowPassword ("foobar" :: Password)"foobar"

You should generally not use this function in production settings, as you don't want to accidentally print a password anywhere, like logs, network responses, database entries, etc.

This will mostly be used by other libraries to handle the actual password internally, though it is conceivable that, even in a production setting, a password might have to be handled in an unsafe manner at some point.