jBCrypt alternative? Officially threadsafe, with a bigger community

Question

To hash passwords (one-way), it looks like bcrypt is the best.

I am about to start using jBCrypt, but I have a few worries:

• No mailing list.
• Very low activity overall.
• Bug tracker has only ever had 1 issue, and this 1 issue has not received any sign of activity.
• Only 3 versions have ever been released.
• jBCrypt does not claim to be threadsafe. While most people seem to agree that the source code looks threadsafe, a clear statement on the official website would be much better.

Is there a similar, more mainstream library that everyone is using, and that I missed somehow? (Java, open source)
Or is it actually the "most mainstream" one?

Introjection

It should be thread safe (code.google.com/p/jbcrypt/issues/detail?id=2) – Sowers

Now that the project is on Google and has a Google Group, maybe it will gain more traction. code.google.com/p/jbcrypt – Sowers

FWIW, the cited question (and accepted answer) claiming that jBcrypt is not threadsafe is dubious / wrong. See https://mcmap.net/q/1469833/-is-jbcrypt-0-3-threadsafe for more recent information. – Whitlow

its now on github github.com/djmdjm/jBCrypt – Prejudge

Answer 1

BCrypt is a clever but 'simple' algorithm. The Java code is 700 lines long (including comments, and 300 lines of hexadecimal constants) which is simply a port of the original code

That's not a complicated framework with dozens of modules. It can't have regular announcement about milestones reached. It just works... You'll probably have 1 change in the next few years due to a security issue found by a particularly smart security researcher, but you won't have a community built around that, improvements are not expected as the original algorithm is already implemented

Tests are here to prove the consistency with the C version, I would choose it

Loriannlorianna

I created issues to address each of my worries, and now it looks like the project is getting a bit of activity after all :-) I decided to integrate this library and it seems to work well so far. – Introjection