密码哈希

from argon2 import PasswordHasher
from argon2.exceptions import VerifyMismatchError

ph = PasswordHasher()          # 默认即 Argon2id，自动生成随机盐
h = ph.hash("mypassword")
print(h)
# $argon2id$v=19$m=19456,t=2,p=1$c29tZXNhbHQ$...  参数、盐、摘要全编码在字符串里

try:
    ph.verify(h, "mypassword")   # 正确 -> 返回 True
except VerifyMismatchError:
    print("密码错误")

import hashlib, time

t0 = time.perf_counter()
for _ in range(10000):
    hashlib.sha256(b"mypassword").digest()
print("SHA-256 x10000:", time.perf_counter() - t0, "秒")   # 毫秒级

t0 = time.perf_counter()
ph.hash("mypassword")            # 单次
print("Argon2id x1:", time.perf_counter() - t0, "秒")      # 数百毫秒级

$argon2id$v=19$m=19456,t=2,p=1$<base64盐>$<base64摘要>
   算法   版本      参数         随机盐          摘要

# Argon2id（argon2-cffi）
python3 -c "from argon2 import PasswordHasher; print(PasswordHasher().hash('mypassword'))"
python3 -c "from argon2 import PasswordHasher; print(PasswordHasher().verify('\$argon2id\$...', 'mypassword'))"

# bcrypt
python3 -c "import bcrypt; print(bcrypt.hashpw(b'mypassword', bcrypt.gensalt(12)).decode())"
python3 -c "import bcrypt; print(bcrypt.checkpw(b'mypassword', b'\$2b\$12\$...'))"

# passlib（多算法统一接口）
python3 -c "from passlib.hash import bcrypt; print(bcrypt.using(rounds=12).hash('mypassword'))"

# PBKDF2（标准库自带）
python3 -c "import hashlib, binascii, os; salt=os.urandom(16); print(binascii.hexlify(hashlib.pbkdf2_hmac('sha256', b'mypassword', salt, 600000)).decode())"

# bcrypt（npm i bcrypt）
node -e "const bcrypt=require('bcrypt'); bcrypt.hash('mypassword', 12).then(console.log)"
node -e "const bcrypt=require('bcrypt'); bcrypt.compare('mypassword', '\$2b\$...').then(console.log)"

# Argon2（npm i argon2）
node -e "const argon2=require('argon2'); argon2.hash('mypassword').then(console.log)"

# scrypt（crypto 内置，无需安装）
node -e "const crypto=require('crypto'); const salt=crypto.randomBytes(16); crypto.scrypt('mypassword', salt, 64, {N:131072}, (e,k)=>console.log(k.toString('hex')))"

# Apache htpasswd 生成/验证 bcrypt
htpasswd -nbB admin secret123
htpasswd -bv /etc/nginx/.htpasswd admin secret123

# openssl：Linux 系统密码格式的 SHA-512crypt（$6$）与 bcrypt
openssl passwd -6 mypassword
openssl passwd -bcrypt mypassword
openssl passwd -6 -salt abc123 mypassword     # 同盐同密码 -> 同哈希，可用于验证

# mkpasswd（whois 包附带）
mkpasswd -m sha-512 mypassword

# PBKDF2 / scrypt 派生密钥
openssl kdf -keylen 32 -kdfopts pass:password:salt:salt:iter:600000 PBKDF2
openssl kdf -keylen 32 -kdfopts pass:password:salt:salt:n:16384:r:8:p:1 scrypt

# argon2 命令行工具
# 注意：-m N 表示内存为 2^N KiB，-m 16 即 64 MiB（不是 16 KiB，也别当 65536 MiB）
echo -n "mypassword" | argon2 somesalt -id -t 3 -m 16 -p 1 -l 32
# 命令行传盐仅适合实验；生产务必用库函数自动生成随机盐

# 看自己账号用的算法：第二字段前缀 $6$=SHA-512crypt，$2b$=bcrypt，$argon2id$=Argon2
grep $USER /etc/shadow | cut -d: -f2 | cut -c1-12

# Python 生成系统格式哈希
# 注意：crypt 模块在 Python 3.13 中已被移除（3.11 起弃用），
# 新代码改用 passlib 或直接 openssl passwd -6
python3 -c "import crypt; print(crypt.crypt('mypassword', crypt.mksalt(crypt.METHOD_SHA512)))"

# Django：默认 PBKDF2，PASSWORD_HASHERS 第一项可换 Argon2id（需 pip install argon2-cffi）
python3 -c "from django.contrib.auth.hashers import make_password; print(make_password('mypassword'))"
python3 -c "from django.contrib.auth.hashers import make_password; print(make_password('mypassword', hasher='argon2'))"
python3 -c "from django.contrib.auth.hashers import check_password; print(check_password('mypassword', 'pbkdf2_sha256\$...'))"

// Spring Security：生产应配 DelegatingPasswordEncoder（{bcrypt}... 前缀自动路由）
BCryptPasswordEncoder bEncoder = new BCryptPasswordEncoder(12);
String hash = bEncoder.encode("mypassword");
boolean match = bEncoder.matches("mypassword", hash);

Argon2PasswordEncoder aEncoder = new Argon2PasswordEncoder();
String hash2 = aEncoder.encode("mypassword");