how to generate bcrypt 2a variation hash instead of 2y?

Question

On my linux machine, I'm able to generate bcrypt hash from command line using htpassword

htpasswd -bnBC 10 "" password | tr -d ':\n'

however it generates "$2y$" but I need "$2a$" (bcrypt 2a). How can I achieve it?

Solution

You haven't mentioned your use case, but generally, if it's a modern htpasswd implementation, it's generating a $2a$-compatible hash (null-terminated, UTF-8 encoded), even though it's using $2y$ to label the variant.

In other words, you could probably literally replace the 2y with 2a, and it should work.

This StackOverflow answer goes into more detail:

There is no difference between 2a, 2x, 2y, and 2b. If you wrote your implementation correctly, they all output the same result.

All of the pre-modern variants are rooted in buggy implementations - either in OpenBSD, or in PHP's crypt_blowfish. If you're working with any modern platform, the hash formats should now be interchangeable.

If you actually need to generate one of the pre-modern (buggy) hashes, you'll have to find an implementation from before the bug was fixed.

Comments

[Jeff Schaller]

Related security.stackexchange.com/a/38796/78324

[thrig]

Fedora has e.g. the perl-Crypt-Eksblowfish module that can generate these, will a little code