Usage of Password4j

Password4j uses 3 verbs:

• hash in order to hash a plain text password
• check in order to check and hash against a plain text password
• update in order to update an hash after it is checked.

A possible statement is

Hash hash = Password.hash(plaintTextPassword)
                    .addNewRandomSalt()
                    .addPepper(somePepper)
                    .withSCrypt();       

which hashes a plainTextPassword with scrypt prepending somePepper and adding a randomly generated salt.

Aside from indentation, this is just a one line of Java code!

For more information about Password4j statements, see here.

The Hash object

An object of type Hash is always returned when you use the hash verb. For example:

Hash hash = Password.hash(plainTextPassword)...

It always contains:

Attribute	Example
The computed hash as String	hash.getResult()
The computed hash as byte[]	hash.getBytes()
The salt used during the computation as String	hash.getSalt()
The pepper used for the computation as CharSequence	hash.getPepper()
A singleton instance of the HashingFunction used for the computation	hash.getHashingFunction()

The HashUpdate object

An object of type HashUpdate is always returned when you use the update verb. For example:

HashUpdate update = Password.check(hash, plainTextPassword)...andUpdate()...

It always contains:

Attribute	Example
A boolean which tells if the check is passed.	update.isVerified()
An Hash object containing the information of the refreshed hash. If the check has not passed, this is null.	update.getHash()