Crypt::Bcrypt(3pm)

💖 Crypt::Bcrypt 💖

okay bestie, so you wanna hash passwords? say less. this is Crypt::Bcrypt — a modern bcrypt implementation, written by Leon Timmermans, and it's currently at version 0.011. it's the Perl module you call when you need bcrypt to just work, no drama, no vibes off. 🎀

---

✨ SYNOPSIS ✨

use Crypt::Bcrypt qw/bcrypt bcrypt_check/;

my $hash = bcrypt($password, '2b', 12, $salt);

if (bcrypt_check($password, $hash)) {
   ...
}

---

🦋 DESCRIPTION 🦋

This module gives you a modern and user-friendly implementation of the bcrypt password hash. it's giving "i have my life together" energy. 💅

okay but real talk, there's a bcrypt thing you need to know: in bcrypt, passwords may only contain 72 characters and may not contain any null-byte. that's just bcrypt being bcrypt. 😭 to work around this limitation, this module supports prehashing the input in a way that prevents password shucking. so you get the flexibility without accidentally weakening your hashes. slay.

also important: the password is always expected to come as a (utf8-encoded) byte-string. no exceptions, no "but i passed a string", byte-string. periodt. 💖

---

🌸 FUNCTIONS 🌸

⭐ bcrypt($password, $subtype, $cost, $salt)

This computes the bcrypt hash for $password in $subtype, with $cost and $salt. that's the whole job. 🤝

Valid subtypes are:

• "2b" — this is the subtype the rest of the world has been using since 2014. you should use this unless you have a very specific reason to use something else. it's the main character of subtypes. 👑
• "2a" — this is an old and subtly buggy version of bcrypt. it's mainly useful for Crypt::Eksblowfish compatibility. lowkey a museum piece. 🙈
• "2y" — this type is considered equivalent to "2b", and is only commonly used on php.
• "2x" — this is a very broken version that is only useful for compatibility with ancient php versions. do not pick this for fun, bestie. 💀

and the numbers:

• $cost must be between 4 and 31 (inclusive).
• $salt must be exactly 16 bytes.

no cap: that salt length is not a suggestion. exactly 16. 🎀

🎀 bcrypt_check($password, $hash)

This checks if the $password satisfies the $hash, and does so in a timing-safe manner. yes, timing-safe. we don't leak secrets through vibes here. 🔥

💜 bcrypt_prehashed($password, $subtype, $cost, $salt, $hash_algorithm)

This works like the "bcrypt" function, but pre-hashes the password using the specified hash. this is mainly useful to get around that 72 character limit we keep talking about. 🫶

currently 'sha256', 'sha384' and 'sha512' are supported (but note that sha512 doesn't actually fit in bcrypt's input limit so is a bit moot 😭), and this is keyed with the salt to prevent password shucking. iconic security behaviour honestly.

if $hash_algorithm is an empty string, it will perform a normal "bcrypt" operation. (yes, the prehash function does the non-prehash thing. we don't make the rules. 🙈)

🧚 bcrypt_check_prehashed($password, $hash)

This verifies pre-hashed passwords as generated by "bcrypt_prehashed". the matching bestie to the function above. 💖

🌈 bcrypt_needs_rehash($hash, $wanted_subtype, $wanted_cost, $wanted_hash = '')

This returns true if the bcrypt hash uses a different subtype, cost or hash algorithm than desired. basically it's your little "glow-up time?" alarm. ⭐

🍓 bcrypt_supported_prehashes()

This returns a list of supported prehashes. currently that's ('sha256', 'sha384', 'sha512') but in the future it may include more. so like, check it, don't assume it. iykyk. 💅

---

👀 SEE OTHER 👀

• Crypt::Passphrase — this is usually a better approach to managing your passwords. it can use this module via Crypt::Passphrase::Bcrypt. it facilitates upgrading the algorithm parameters or even the algorithm itself. if you're managing a lot of passwords, this is the friend who has a planner. 🎀
• Crypt::Eksblowfish::Bcrypt — this also offers bcrypt, but only supports the "2a" subtype. so, one trick, but it's a classic. ✨

---

💅 AUTHOR 💅

Leon Timmermans <leont@cpan.org>

---

📜 COPYRIGHT AND LICENSE 📜

This software is copyright (c) 2021 by Leon Timmermans.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself. 🫶

---

and that's the whole page, bestie!! go forth and hash responsibly. this was perl v5.42.3, documented on 2026-08-20, under the name Crypt::Bcrypt(3pm). mwah. 💖✨🎀