What is the user password algorithm and format of the stored passwords?
How To articles are not official guidelines or officially supported documentation. They are community-contributed content and may not always reflect the latest updates to Liferay DXP. We welcome your feedback to improve How To articles!
While we make every effort to ensure this Knowledge Base is accurate, it may not always reflect the most recent updates or official guidelines.We appreciate your understanding and encourage you to reach out with any feedback or concerns.
Legacy Article
You are viewing an article from our legacy "FastTrack"
publication program, made available for informational purposes. Articles
in this program were published without a requirement for independent
editing or verification and are provided"as is" without
guarantee.
Before using any information from this article, independently verify its
suitability for your situation and project.
Issue
- We would like to understand the formatting of passwords as they're saved in Liferay. What algorithm, salt, and hash format is being used to store passwords?
Resolution
-
Example Password: {PBKDF2WABCDMAEFGH1}ABCDoABC/ABCD644e/XY3ZAbcde8hI0jKLOnBcEE7U7TuuV
- The example is made up of 8 bytes of salt, 4 bytes for "number of rounds" and 4 bytes for "key size". The 20 bytes are the hash of the password (using SHA1, which produces a digest of 160 bits=20 bytes)
- The example password is 48 characters, which originally was 36 bytes, see Base64 to binary to observe the actual bytes. Base64 encodes in portions of 6bits, hence the 48 characters used in the example password.
- Salt starts with the 9th byte
- The hashed format starts with the 17th byte
Did this article resolve your issue ?