A Java cryptographic library for hashing and verifying passwords with Argon2, bcrypt, scrypt, PBKDF2, and Balloon Hashing.
Password4j is a Java cryptographic library that provides secure password hashing and verification using modern algorithms like Argon2, bcrypt, scrypt, PBKDF2, and Balloon Hashing. It is designed to protect passwords in databases by offering an easy-to-use, customizable, and portable solution that adheres to cryptographic standards and is optimized for JVM performance.
Java developers and Android developers who need to securely hash and verify passwords in their applications, especially those managing user authentication systems.
Developers choose Password4j for its comprehensive support of modern password hashing algorithms, ease of configuration, and built-in tools for performance optimization and hash migration, all while maintaining high security standards and JVM compatibility.
Java cryptographic library that supports Argon2, bcrypt, scrypt and PBKDF2 aimed to protect passwords in databases. Easy to use by design, highly customizable, secure and portable. All the implementations follow the standards and have been reviewed to perform better in the JVM.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Fully supports Argon2, bcrypt, scrypt, PBKDF2, and Balloon Hashing, ensuring adherence to current cryptographic standards as highlighted in the algorithm list.
Allows setup via programmatic code or a property file, with a built-in SystemChecker tool to find optimal parameters based on system performance, detailed in the Configuration and Performance sections.
Provides easy tools to update insecure hashes from legacy algorithms like MD5 to modern KDFs, demonstrated in the 'Update the hash' examples.
Runs on Java 8+ and Android API 21+, as confirmed by badges and installation notes, making it versatile for JVM and mobile environments.
Performance and availability of algorithms like PBKDF2 and SHA families depend on the underlying JVM's Security Services, which can lead to inconsistencies across environments, as noted in the algorithm tables.
Requires benchmarking in the target system to set optimal parameters, which adds complexity; the README warns that misconfigured SecureRandom can cause 'huge performance drops'.
Does not offer out-of-the-box integration with popular Java frameworks like Spring Security, requiring manual setup compared to native solutions.