SHA2 password hashing in java

Question

I'm trying to hash some passwords with SHA2.

Where can I get a snippet of java code for make that?

I have seen that post but I have something missing: SHA2 password storage with Java

 Mac mac = Mac.getInstance("HmacSha256");
 SecretKeySpec secret = new SecretKeySpec(key.getBytes(), "HmacSha256");
 mac.init(secret);
 byte[] shaDigest = mac.doFinal(phrase.getBytes());
 String hash = "";
 for(byte b:shaDigest) {
     hash += String.format("%02x",b);
 }

The phrase is the String I want encode right? And what is the key (line 2)

Thanks in advance

FYI: You may read some questions about password hashing. While it is good to hash passwords, it is non-trivial to do it correctly. This question has some good answers: Suggestions for library to hash passwords in Java — Adam Paynter
– Adam Paynter, Commented Jul 27, 2011 at 9:19

rossum · Accepted Answer · 2011-07-27 11:12:57Z

25

First, you need to be clear what it is you want to do. You say you want to hash a password, but the code you are using is for a MAC (Message Authentication Code), specifically, HMAC.

Hashes and MACs are different things for different purposes (though HMAC does involve using a hash). You need to be sure you are using the right one for your requirement.

The reason you are being asked to supply a key is because MACs need a key. Hashes do not:

public byte[] hash(String password) throws NoSuchAlgorithmException {
    MessageDigest sha256 = MessageDigest.getInstance("SHA-256");        
    byte[] passBytes = password.getBytes();
    byte[] passHash = sha256.digest(passBytes);
    return passHash;
}

answered Jul 27, 2011 at 11:12

rossum

15.7k2 gold badges26 silver badges40 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

thorin86 · Accepted Answer · 2014-08-21 12:29:26Z

I modified a little rossum's code, added salt and convert returning type to String, add try/catch, maybe it will help to someone:

    public String hash(String password) {
    try {
        MessageDigest sha256 = MessageDigest.getInstance("SHA-256");
        String salt = "some_random_salt";
        String passWithSalt = password + salt;
        byte[] passBytes = passWithSalt.getBytes();
        byte[] passHash = sha256.digest(passBytes);             
        StringBuilder sb = new StringBuilder();
        for(int i=0; i< passHash.length ;i++) {
            sb.append(Integer.toString((passHash[i] & 0xff) + 0x100, 16).substring(1));         
        }
        String generatedPassword = sb.toString();
        return generatedPassword;
    } catch (NoSuchAlgorithmException e) { e.printStackTrace(); }       
    return null;
}

Dapeng · Accepted Answer · 2011-07-27 09:10:22Z

10

you may consider using commons-codec's implementation

String hash = org.apache.commons.codec.digest.DigestUtils.sha256Hex(password +"salt");

answered Jul 27, 2011 at 9:10

Dapeng

1,71613 silver badges25 bronze badges

1 Comment

Ky - Over a year ago

This is not in Java SE

score 1 · Accepted Answer · 2011-07-27 06:36:55Z

1

Phrase would be the password that you're trying to protect. key is the salt, a unique (and known) string appended to your password before hashing, to defeat rainbow tables. Or it should be, at least. Your code is just taking it from the password itself, which is kind of pointless. It should be a long random string that is stored together with the password digest.

edited Jul 27, 2011 at 6:36

answered Jul 27, 2011 at 6:29

user684934

Collectives™ on Stack Overflow

SHA2 password hashing in java

4 Answers 4

Comments

Comments

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related