Pashly

Pashly generates passwords, hashes them with configurable parameters, and verifies passwords against hashes — built to support IAM/CIAM migration work (moving user stores between systems like Auth0, Okta, Keycloak, Django, WordPress, ASP.NET Identity, and Duende IdentityServer).

Installation

go install github.com/cerberauth/pashly@latest

Pre-built binaries, Docker images, and platform packages (deb/rpm/apk, Homebrew, Scoop, AUR, winget, Chocolatey, Snap) are published on each release.

Commands

pashly generate — generate random passwords

# One password, 20 characters, letters+digits+symbols (defaults)
pashly generate

# Five 32-character alphanumeric-only passwords
pashly generate -n 5 -l 32 --charset alnum

# Exclude visually ambiguous characters (il1Lo0O), machine-readable output
pashly generate -l 24 --no-ambiguous --format json

# A custom character set
pashly generate --charset 'custom:ABCDEF0123456789' -l 16

pashly hash — hash a password

# Argon2id with current OWASP-recommended defaults (the tool's own default algorithm)
pashly hash --stdin
# (prompts securely if stdin is a terminal, or reads a piped password)

# bcrypt, explicit cost
echo -n 'correct horse battery staple' | pashly hash --stdin -a bcrypt --cost 12

# scrypt, pbkdf2 variants
pashly hash --password-file ./pw.txt -a scrypt --iterations 17   # N = 2^17
pashly hash --password-file ./pw.txt -a pbkdf2-sha256 --iterations 600000

--password is accepted for convenience but warns on stderr — prefer --stdin or --password-file so the plaintext never appears in shell history or ps output.

Migration-flavored: hashing for a specific platform's bulk import

# Hash for Auth0's bulk user import (custom_password_hash / bcrypt)
pashly hash --stdin --target auth0 > auth0-custom-password-hash.json

# Hash for Okta's Import Hashed Password API (bcrypt)
pashly hash --stdin --target okta

# Hash for a Keycloak realm import (pbkdf2-sha256, CredentialRepresentation)
pashly hash --stdin --target keycloak > keycloak-credential.json

# Hash for a Django user fixture (PBKDF2PasswordHasher)
pashly hash --stdin --target django

# Hash for WordPress's current bcrypt-based password format
pashly hash --stdin --target wordpress

# Hash for an ASP.NET Core Identity v3 user store (PBKDF2-HMAC-SHA512)
pashly hash --stdin --target aspnet-identity

--target selects the platform's algorithm and current recommended parameters automatically; it cannot be combined with -a/--algorithm. Tuning flags (--cost, --iterations, ...) still work under --target to override that platform's defaults.

pashly verify — verify a password against a hash

pashly verify --hash '$argon2id$v=19$m=19456,t=2,p=1$...' --stdin
pashly verify --hash-file ./user.hash --password-file ./attempt.txt

Exit codes are scriptable: 0 = match, 1 = no match, 2 = error (bad input, unparsable hash). Algorithm/target auto-detection covers pashly's own canonical formats, bcrypt, legacy md5-crypt/phpass, and every --target platform's native encoding; override with --algorithm (an algorithm ID like bcrypt, or a target name like auth0) if needed.

Migration-flavored: verifying an exported hash during a cutover

# Verify a login attempt against a hash exported from Auth0's bulk export
pashly verify --hash-file ./exported-auth0-hash.json --stdin
echo "exit=$?"   # use in a CI/cutover script to gate on real user data

# Verify against a Django-formatted hash pulled from a database dump
pashly verify --hash 'pbkdf2_sha256$720000$...$...' --password-file ./attempt.txt

# Force interpretation as a specific legacy format during a phpBB/Drupal 7 migration
pashly verify --hash '$P$...' --algorithm phpass --stdin

pashly info — inspect a hash

pashly info '$argon2id$v=19$m=19456,t=2,p=1$VEL4z...$80p0w...'
pashly info --format json "$(cat ./user.hash)"

Prints the detected (or --algorithm-forced) algorithm, its string encoding, and its parameters — useful when auditing what an exported user store is actually using before planning a migration.

Supported algorithms

ID	Hash target?	Verify/info?	Notes
argon2id	yes (default)	yes	OWASP-recommended default; PHC string format
argon2i	yes	yes	PHC string format
bcrypt	yes	yes	native $2a$/$2b$/$2y$ encoding
scrypt	yes	yes	pashly's own PHC-style convention (ln=)
pbkdf2-sha256	yes	yes	PHC-style, passlib convention
pbkdf2-sha512	yes	yes	PHC-style, passlib convention
pbkdf2-sha1	yes	yes	legacy interop only; never the default
md5-crypt	no	yes	legacy ($1$); verify/info only
phpass	no	yes	legacy ($P$/$H$); verify/info only

--target platforms

auth0, okta, keycloak, django, wordpress, aspnet-identity.

Security notes

• Passwords are never logged, at any verbosity level.
• verify uses a constant-time comparison of the derived key.
• Default parameters follow the current OWASP Password Storage Cheat Sheet.
• Legacy formats (md5-crypt, phpass, pbkdf2-sha1) exist for migrating away from older systems — pashly will never produce them as a hash target.

Development

go build ./...
go test ./...

License

MIT — see LICENSE.