Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
x/crypto/bcrypt: API to check hash format #20896
golang.org/x/crypto/bcrypt  does not provide an official API to verify that the hash format is good one. The current sources indicates  that one can use bcrypt.Cost() as that parses and verifies the whole hash string. But the documentation does not reflect that a successful return from the function indicates a valid hash. Also the documentation implies that bcrypt.ErrHashTooShort can only be returned from CompareHashAndPassword when the Cost function can also return it.
It would be nice to have an explicit API to check hash format and perhaps check that it was created by older version so a password change can be scheduled in such case.