prestodb/presto · error · HashedPasswordException

Invalid BCrypt password

Error message

Invalid BCrypt password

What it means

Catch block in getBCryptCost: the stored password string cannot be parsed as a version-2A BCrypt hash, so its cost factor cannot be extracted. Fires when the password file entry marked $2y is malformed or truncated; wrapped as HashedPasswordException for the authenticator.

Source

Thrown at presto-password-authenticators/src/main/java/com/facebook/presto/password/file/EncryptionUtil.java:49

import static com.google.common.io.BaseEncoding.base16;
import static java.nio.charset.StandardCharsets.UTF_8;
import static java.util.Objects.requireNonNull;

public final class EncryptionUtil
{
    private static final Logger LOG = Logger.get(EncryptionUtil.class);
    private static final int BCRYPT_MIN_COST = 8;
    private static final int PBKDF2_MIN_ITERATIONS = 1000;

    private EncryptionUtil() {}

    public static int getBCryptCost(String password)
    {
        try {
            return BCrypt.Version.VERSION_2A.parser.parse(password.getBytes(UTF_8)).cost;
        }
        catch (IllegalBCryptFormatException e) {
            throw new HashedPasswordException("Invalid BCrypt password", e);
        }
    }

    public static int getPBKDF2Iterations(String password)
    {
        return PBKDF2Password.fromString(password).iterations();
    }

    public static boolean doesBCryptPasswordMatch(String inputPassword, String hashedPassword)
    {
        return BCrypt.verifyer().verify(inputPassword.toCharArray(), hashedPassword).verified;
    }

    /**
     * @Deprecated using PBKDF2WithHmacSHA1 is deprecated and clients should switch to PBKDF2WithHmacSHA256
     */
    public static boolean doesPBKDF2PasswordMatch(String inputPassword, String hashedPassword)
    {

View on GitHub (pinned to 55bb57d202)

Solutions

1. Regenerate the password entry with a valid BCrypt hash in $2y format
2. Verify the password file is not corrupted or hand-edited
3. Log and skip the malformed entry rather than failing the whole file load

When it happens

Trigger: Thrown at presto-password-authenticators/src/main/java/com/facebook/presto/password/file/EncryptionUtil.java:49 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/4b9b7dd55479755d. Report an issue: GitHub.