What hash algorithms does /etc/shadow accept?

I've tried generating password hashes from PHP, using password_hash("password1234", PASSWORD_DEFAULT);, but that doesn't seem to work when I try to authenticate once I replace a user's password to the hash provided by the hashes I generate with PHP.

Any reason why blowfish doesn't work? (I think PHP uses blowfish by default)

  • You should probably not be recreating the wheel. Ubuntu's default method is SHA512 . Although I can not find the documentation, I do not think you can use blowfish, MD5, or SHA256 any longer as they are considered insecure.
    – Panther
    Nov 25, 2017 at 15:23

2 Answers 2


Passwords are hashed using the library functioncrypt(3); see the manual page for crypt(3). The function chooses the encryption function based on the format of the salt:

  • $1$salt_chars$: use MD5
  • $2a$salt_chars$: use Blowfish (not standard, most likely not available)
  • $5$salt_chars$: use SHA-256
  • $6$salt_chars$: use SHA-512
  • Not in the form $type$salt_chars$: use DES as in the old days.

I have no idea if you can use PHP to emulate exactly what crypt(3) does.


I've tried generating password hashes from PHP, using password_hash("password1234", PASSWORD_DEFAULT)...

Then you need to save the output in the format that /etc/shadow expects, which, as explained by AlexP, is:


password_hash's output is different. It returns:


For example, a password of a (password_hash("a", PASSWORD_DEFAULT)) outputs, for me:


And the salt is weirdly part of the hash:

password_hash("a", PASSWORD_DEFAULT, ['salt'=>'abcdefghijklmnopqrstuv'])
// $2y$10$abcdefghijklmnopqrstuuj/LkVFwQAC6H0GkC0f1Bcmj82rKvDn.

But the shadow version is:


See the salt in the second field?

Anyway, I don't know what PHP is doing here. You should probably use crypt, but I'm no PHP expert and that's a question for SO.

Also, for me, man crypt reports that 2y is not understood by it:

If salt is a character string starting with the characters "$id$"  fol-
lowed by a string terminated by "$":


then  instead  of  using  the DES machine, id identifies the encryption
method used and this then determines  how  the  rest  of  the  password
string is interpreted.  The following values of id are supported:

      ID  | Method
      1   | MD5
      2a  | Blowfish (not in mainline glibc; added in some
          | Linux distributions)
      5   | SHA-256 (since glibc 2.7)
      6   | SHA-512 (since glibc 2.7)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.