Bcrypt Hash & Verify — TypeScript source

// Pure-TypeScript bcrypt (Blowfish-based password hashing) - zero dependencies.
// Implements the full algorithm from the Provos-Mazieres paper (USENIX '99):
// EksBlowfish key setup, the 64-fold encryption of "OrpheanBeholderScryDoubt",
// and OpenBSD's $2b$ hash format. Produces hashes that interoperate with
// bcrypt implementations everywhere (verified against OpenBSD/Go reference
// vectors in bcrypt.test.ts).
//
// The Blowfish P-array (18 words) and S-boxes (4 x 256 words) are the first
// 8336 hex digits of the fractional part of pi, stored below as hex strings
// and parsed once into Uint32Arrays at module load.

/** bcrypt's non-standard Base64 alphabet ('.' + '/' first, then alphanumeric). */
const B64_CHARS = './ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';

const B64_INDEX = (() => {
  const t = new Int16Array(128).fill(-1);
  for (let i = 0; i < B64_CHARS.length; i++) t[B64_CHARS.charCodeAt(i)] = i;
  return t;
})();

/** The Blowfish P-array: first 18 words of pi's hex expansion. */
const P_HEX =
  '243f6a8885a308d313198a2e03707344a4093822299f31d0082efa98ec4e6c89452821e6' +
  '38d01377be5466cf34e90c6cc0ac29b7c97c50dd3f84d5b5b54709179216d5d98979fb1b';

/** The four Blowfish S-boxes: the following 1024 words of pi's hex expansion. */
const S_HEX =
  'd1310ba698dfb5ac2ffd72dbd01adfb7b8e1afed6a267e96ba7c9045f12c7f9924a19947' +
  'b3916cf70801f2e2858efc16636920d871574e69a458fea3f4933d7e0d95748f728eb658' +
  '718bcd5882154aee7b54a41dc25a59b59c30d5392af26013c5d1b023286085f0ca417918' +
  'b8db38ef8e79dcb0603a180e6c9e0e8bb01e8a3ed71577c1bd314b2778af2fda55605c60' +
  'e65525f3aa55ab945748986263e8144055ca396a2aab10b6b4cc5c341141e8cea15486af' +
  '7c72e993b3ee1411636fbc2a2ba9c55d741831f6ce5c3e169b87931eafd6ba336c24cf5c' +
  '7a325381289586773b8f48986b4bb9afc4bfe81b6628219361d809ccfb21a991487cac60' +
  '5dec8032ef845d5de98575b1dc262302eb651b8823893e81d396acc50f6d6ff383f44239' +
  '2e0b4482a484200469c8f04a9e1f9b5e21c66842f6e96c9a670c9c61abd388f06a51a0d2' +
  'd8542f68960fa728ab5133a36eef0b6c137a3be4ba3bf0507efb2a98a1f1651d39af0176' +
  '66ca593e82430e888cee8619456f9fb47d84a5c33b8b5ebee06f75d885c12073401a449f' +
  '56c16aa64ed3aa62363f77061bfedf72429b023d37d0d724d00a1248db0fead349f1c09b' +
  '075372c980991b7b25d479d8f6e8def7e3fe501ab6794c3b976ce0bd04c006bac1a94fb6' +
  '409f60c45e5c9ec2196a246368fb6faf3e6c53b51339b2eb3b52ec6f6dfc511f9b30952c' +
  'cc814544af5ebd09bee3d004de334afd660f2807192e4bb3c0cba85745c8740fd20b5f39' +
  'b9d3fbdb5579c0bd1a60320ad6a100c6402c7279679f25fefb1fa3cc8ea5e9f8db3222f8' +
  '3c7516dffd616b152f501ec8ad0552ab323db5fafd23876053317b483e00df829e5c57bb' +
  'ca6f8ca01a87562edf1769dbd542a8f6287effc3ac6732c68c4f5573695b27b0bbca58c8' +
  'e1ffa35db8f011a010fa3d98fd2183b84afcb56c2dd1d35b9a53e479b6f84565d28e49bc' +
  '4bfb9790e1ddf2daa4cb7e3362fb1341cee4c6e8ef20cada36774c01d07e9efe2bf11fb4' +
  '95dbda4dae909198eaad8e716b93d5a0d08ed1d0afc725e08e3c5b2f8e7594b78ff6e2fb' +
  'f2122b648888b812900df01c4fad5ea0688fc31cd1cff191b3a8c1ad2f2f2218be0e1777' +
  'ea752dfe8b021fa1e5a0cc0fb56f74e818acf3d6ce89e299b4a84fe0fd13e0b77cc43b81' +
  'd2ada8d9165fa2668095770593cc7314211a1477e6ad206577b5fa86c75442f5fb9d35cf' +
  'ebcdaf0c7b3e89a0d6411bd3ae1e7e4900250e2d2071b35e226800bb57b8e0af2464369b' +
  'f009b91e5563911d59dfa6aa78c14389d95a537f207d5ba202e5b9c5832603766295cfa9' +
  '11c819684e734a41b3472dca7b14a94a1b5100529a532915d60f573fbc9bc6e42b60a476' +
  '81e6740008ba6fb5571be91ff296ec6b2a0dd915b6636521e7b9f9b6ff34052ec5855664' +
  '53b02d5da99f8fa108ba47996e85076a4b7a70e9b5b32944db75092ec4192623ad6ea6b0' +
  '49a7df7d9cee60b88fedb266ecaa8c71699a17ff5664526cc2b19ee1193602a575094c29' +
  'a0591340e4183a3e3f54989a5b429d656b8fe4d699f73fd6a1d29c07efe830f54d2d38e6' +
  'f0255dc14cdd20868470eb266382e9c6021ecc5e09686b3f3ebaefc93c9718146b6a70a1' +
  '687f358452a0e286b79c5305aa5007373e07841c7fdeae5c8e7d44ec5716f2b8b03ada37' +
  'f0500c0df01c1f040200b3ffae0cf51a3cb574b225837a58dc0921bdd19113f97ca92ff6' +
  '9432477322f547013ae5e58137c2dadcc8b576349af3dda7a94461460fd0030eecc8c73e' +
  'a4751e41e238cd993bea0e2f3280bba1183eb3314e548b384f6db9086f420d03f60a04bf' +
  '2cb8129024977c795679b072bcaf89afde9a771fd9930810b38bae12dccf3f2e5512721f' +
  '2e6b7124501adde69f84cd877a5847187408da17bc9f9abce94b7d8cec7aec3adb851dfa' +
  '63094366c464c3d2ef1c18473215d908dd433b3724c2ba1612a14d432a65c45150940002' +
  '133ae4dd71dff89e10314e5581ac77d65f11199b043556f1d7a3c76b3c11183b5924a509' +
  'f28fe6ed97f1fbfa9ebabf2c1e153c6e86e34570eae96fb1860e5e0a5a3e2ab3771fe71c' +
  '4e3d06fa2965dcb999e71d0f803e89d65266c8252e4cc9789c10b36ac6150eba94e2ea78' +
  'a5fc3c531e0a2df4f2f74ea7361d2b3d1939260f19c279605223a708f71312b6ebadfe6e' +
  'eac31f66e3bc4595a67bc883b17f37d1018cff28c332ddefbe6c5aa56558218568ab9802' +
  'eecea50fdb2f953b2aef7dad5b6e2f841521b62829076170ecdd4775619f151013cca830' +
  'eb61bd960334fe1eaa0363cfb5735c904c70a239d59e9e0bcbaade14eecc86bc60622ca7' +
  '9cab5cabb2f3846e648b1eaf19bdf0caa02369b9655abb5040685a323c2ab4b3319ee9d5' +
  'c021b8f79b540b19875fa09995f7997e623d7da8f837889a97e32d7711ed935f16681281' +
  '0e358829c7e61fd696dedfa17858ba9957f584a51b2272639b83c3ff1ac24696cdb30aeb' +
  '532e30548fd948e46dbc312858ebf2ef34c6ffeafe28ed61ee7c3c735d4a14d9e864b7e3' +
  '42105d14203e13e045eee2b6a3aaabeadb6c4f15facb4fd0c742f442ef6abbb5654f3b1d' +
  '41cd2105d81e799e86854dc7e44b476a3d816250cf62a1f25b8d2646fc8883a0c1c7b6a3' +
  '7f1524c369cb749247848a0b5692b285095bbf00ad19489d1462b17423820e0058428d2a' +
  '0c55f5ea1dadf43e233f70613372f0928d937e41d65fecf16c223bdb7cde3759cbee7460' +
  '4085f2a7ce77326ea607808419f8509ee8efd85561d99735a969a7aac50c06c25a04abfc' +
  '800bcadc9e447a2ec3453484fdd567050e1e9ec9db73dbd3105588cd675fda79e3674340' +
  'c5c43465713e38d83d28f89ef16dff20153e21e78fb03d4ae6e39f2bdb83adf7e93d5a68' +
  '948140f7f64c261c94692934411520f77602d4f7bcf46b2ed4a20068d40824713320f46a' +
  '43b7d4b7500061af1e39f62e9724454614214f74bf8b88404d95fc1d96b591af70f4ddd3' +
  '66a02f45bfbc09ec03bd97857fac6dd031cb850496eb27b355fd3941da2547e6abca0a9a' +
  '28507825530429f40a2c86dae9b66dfb68dc1462d7486900680ec0a427a18dee4f3ffea2' +
  'e887ad8cb58ce0067af4d6b6aace1e7cd3375fecce78a399406b2a4220fe9e35d9f385b9' +
  'ee39d7ab3b124e8b1dc9faf74b6d185626a36631eae397b23a6efa74dd5b43326841e7f7' +
  'ca7820fbfb0af54ed8feb397454056acba48952755533a3a20838d87fe6ba9b7d096954b' +
  '55a867bca1159a58cca9296399e1db33a62a4a563f3125f95ef47e1c9029317cfdf8e802' +
  '04272f7080bb155c05282ce395c11548e4c66d2248c1133fc70f86dc07f9c9ee41041f0f' +
  '404779a45d886e17325f51ebd59bc0d1f2bcc18f41113564257b7834602a9c60dff8e8a3' +
  '1f636c1b0e12b4c202e1329eaf664fd1cad181156b2395e0333e92e13b240b62eebeb922' +
  '85b2a20ee6ba0d99de720c8c2da2f728d012784595b794fd647d0862e7ccf5f05449a36f' +
  '877d48fac39dfd27f33e8d1e0a476341992eff743a6f6eabf4f8fd37a812dc60a1ebddf8' +
  '991be14cdb6e6b0dc67b55106d672c372765d43bdcd0e804f1290dc7cc00ffa3b5390f92' +
  '690fed0b667b9ffbcedb7d9ca091cf0bd9155ea3bb132f88515bad247b9479bf763bd6eb' +
  '37392eb3cc1159798026e297f42e312d6842ada7c66a2b3b12754ccc782ef11c6a124237' +
  'b79251e706a1bbe64bfb63501a6b101811caedfa3d25bdd8e2e1c3c9444216590a121386' +
  'd90cec6ed5abea2a64af674eda86a85fbebfe98864e4c3fe9dbc8057f0f7c08660787bf8' +
  '6003604dd1fd8346f6381fb07745ae04d736fccc83426b33f01eab71b08041873c005e5f' +
  '77a057bebde8ae2455464299bf582e614e58f48ff2ddfda2f474ef388789bdc25366f9c3' +
  'c8b38e74b475f25546fcd9b97aeb26618b1ddf84846a0e79915f95e2466e598e20b45770' +
  '8cd55591c902de4cb90bace1bb8205d011a862487574a99eb77f19b6e0a9dc09662d09a1' +
  'c4324633e85a1f0209f0be8c4a99a0251d6efe101ab93d1d0ba5a4dfa186f20f2868f169' +
  'dcb7da83573906fea1e2ce9b4fcd7f5250115e01a70683faa002b5c40de6d0279af88c27' +
  '773f8641c3604c0661a806b5f0177a28c0f586e0006058aa30dc7d6211e69ed72338ea63' +
  '53c2dd94c2c21634bbcbee5690bcb6deebfc7da1ce591d766f05e4094b7c018839720a3d' +
  '7c927c2486e3725f724d9db91ac15bb4d39eb8fced54557808fca5b5d83d7cd34dad0fc4' +
  '1e50ef5eb161e6f8a28514d96c51133c6fd5c7e756e14ec4362abfceddc6c837d79a3234' +
  '92638212670efa8e406000e03a39ce37d3faf5cfabc277375ac52d1b5cb0679e4fa33742' +
  'd382274099bc9bbed5118e9dbf0f7315d62d1c7ec700c47bb78c1b6b21a19045b26eb1be' +
  '6a366eb45748ab2fbc946e79c6a376d26549c2c8530ff8ee468dde7dd5730a1d4cd04dc6' +
  '2939bbdba9ba4650ac9526e8be5ee304a1fad5f06a2d519a63ef8ce29a86ee22c089c2b8' +
  '43242ef6a51e03aa9cf2d0a483c061ba9be96a4d8fe51550ba645bd62826a2f9a73a3ae1' +
  '4ba99586ef5562e9c72fefd3f752f7da3f046f6977fa0a5980e4a91587b086019b09e6ad' +
  '3b3ee593e990fd5a9e34d7972cf0b7d9022b8b5196d5ac3a017da67dd1cf3ed67c7d2d28' +
  '1f9f25cfadf2b89b5ad6b4725a88f54ce029ac71e019a5e647b0acfded93fa9be8d3c48d' +
  '283b57ccf8d5662979132e28785f0191ed756055f7960e44e3d35e8c15056dd488f46dba' +
  '03a161250564f0bdc3eb9e153c9057a297271aeca93a072a1b3f6d9b1e6321f5f59c66fb' +
  '26dcf3197533d928b155fdf5035634828aba3cbb28517711c20ad9f8abcc5167ccad925f' +
  '4de817513830dc8e379d58629320f991ea7a90c2fb3e7bce5121ce64774fbe32a8b6e37e' +
  'c3293d4648de53696413e680a2ae0810dd6db22469852dfd09072166b39a460a6445c0dd' +
  '586cdecf1c20c8ae5bbef7dd1b588d40ccd2017f6bb4e3bbdda26a7e3a59ff453e350a44' +
  'bcb4cdd572eacea8fa6484bb8d6612aebf3c6f47d29be463542f5d9eaec2771bf64e6370' +
  '740e0d8de75b1357f8721671af537d5d4040cb084eb4e2cc34d2466a0115af84e1b00428' +
  '95983a1d06b89fb4ce6ea0486f3f3b823520ab82011a1d4b277227f8611560b1e7933fdc' +
  'bb3a792b344525bda08839e151ce794b2f32c9b7a01fbac9e01cc87ebcc7d1f6cf0111c3' +
  'a1e8aac71a908749d44fbd9ad0dadecbd50ada380339c32ac69136678df9317ce0b12b4f' +
  'f79e59b743f5bb3af2d519ff27d9459cbf97222c15e6fc2a0f91fc719b941525fae59361' +
  'ceb69cebc2a8645912baa8d1b6c1075ee3056a0c10d25065cb03a442e0ec6e0e1698db3b' +
  '4c98a0be3278e9649f1f9532e0d392dfd3a0342b8971f21e1b0a74414ba3348cc5be7120' +
  'c37632d8df359f8d9b992f2ee60b6f470fe3f11de54cda541edad891ce6279cfcd3e7e6f' +
  '1618b166fd2c1d05848fd2c5f6fb2299f523f357a632762393a8353156cccd02acf08162' +
  '5a75ebb56e16369788d273ccde96629281b949d04c50901b71c65614e6c6c7bd327a140a' +
  '45e1d006c3f27b9ac9aa53fd62a80f00bb25bfe235bdd2f671126905b2040222b6cbcf7c' +
  'cd769c2b53113ec01640e3d338abbd602547adf0ba38209cf746ce7677afa1c520756060' +
  '85cbfe4e8ae88dd87aaaf9b04cf9aa7e1948c25c02fb8a8c01c36ae4d6ebe1f990d4f869' +
  'a65cdea03f09252dc208e69fb74e6132ce77e25b578fdfe33ac372e6';

function parseHexWords(hex: string): Uint32Array {
  const out = new Uint32Array(hex.length / 4 / 2);
  for (let i = 0; i < out.length; i++) out[i] = parseInt(hex.slice(i * 8, i * 8 + 8), 16);
  return out;
}

const P_INIT = parseHexWords(P_HEX);
const S_INIT = parseHexWords(S_HEX);

/** Minimum and maximum bcrypt cost factor (log2 rounds). */
export const MIN_COST = 4;
export const MAX_COST = 31;
/** Cost used when bcryptHash gets no explicit cost argument. */
export const DEFAULT_COST = 12;
/** bcrypt only uses the first 72 bytes of the password. */
export const MAX_PASSWORD_BYTES = 72;

/** The magic string bcrypt encrypts 64 times to produce the digest. */
const MAGIC = 'OrpheanBeholderScryDoubt';

const HASH_RE = /^\$2[aby]\$(\d{2})\$([./A-Za-z0-9]{22})([./A-Za-z0-9]{31})$/;

export interface BcryptInfo {
  /** Full version prefix, e.g. '$2b$'. */
  version: string;
  /** Log2 iteration count, 4-31. */
  cost: number;
  /** The 22-character Base64 salt portion. */
  salt: string;
}

/**
 * Derive the bcrypt key data from a password: UTF-8 bytes, truncated to 72.
 * A single NUL terminator is appended unless truncation already reached 72
 * bytes - the exact keying OpenBSD's bcrypt uses.
 */
export function keyData(password: string): Uint8Array {
  const bytes = new TextEncoder().encode(password);
  const truncated = bytes.length > MAX_PASSWORD_BYTES ? bytes.slice(0, MAX_PASSWORD_BYTES) : bytes;
  if (truncated.length >= MAX_PASSWORD_BYTES) return truncated;
  const key = new Uint8Array(truncated.length + 1);
  key.set(truncated);
  key[truncated.length] = 0;
  return key;
}

/** Blowfish round function F(x) = ((S0[a] + S1[b]) ^ S2[c]) + S3[d]. */
function f(S: Uint32Array, x: number): number {
  return (((((S[(x >>> 24) & 0xff] + S[256 + ((x >>> 16) & 0xff)]) >>> 0) ^ S[512 + ((x >>> 8) & 0xff)]) + S[768 + (x & 0xff)]) >>> 0);
}

/** One Blowfish encryption of the (xl, xr) pair, in place of a struct return. */
function encipher(P: Uint32Array, S: Uint32Array, xl: number, xr: number): [number, number] {
  let l = xl;
  let r = xr;
  for (let i = 0; i < 16; i++) {
    l = (l ^ P[i]) >>> 0;
    r = (r ^ f(S, l)) >>> 0;
    const t = l;
    l = r;
    r = t;
  }
  const t = l;
  l = r;
  r = t;
  r = (r ^ P[16]) >>> 0;
  l = (l ^ P[17]) >>> 0;
  return [l, r];
}

/**
 * Read 4 bytes at `offset` (wrapping around `data`) as a big-endian word.
 * Returns the word and the advanced offset - OpenBSD's stream2word.
 */
function stream2word(data: Uint8Array, offset: number): [number, number] {
  let word = 0;
  let j = offset;
  for (let i = 0; i < 4; i++, j++) {
    if (j >= data.length) j = 0;
    word = ((word << 8) | data[j]) >>> 0;
  }
  return [word, j];
}

/** Plain Blowfish key schedule (OpenBSD's expand0state): XOR `data` into P,
 *  then chain (0,0) through 521 encryptions that re-derive P and every S-box
 *  entry. Unlike the salted variant, nothing is XORed into the mixing pair. */
function expand0(P: Uint32Array, S: Uint32Array, data: Uint8Array): void {
  let j = 0;
  for (let i = 0; i < 18; i++) {
    const [w, nj] = stream2word(data, j);
    P[i] = (P[i] ^ w) >>> 0;
    j = nj;
  }
  let l = 0;
  let r = 0;
  for (let i = 0; i < 18; i += 2) {
    [l, r] = encipher(P, S, l, r);
    P[i] = l;
    P[i + 1] = r;
  }
  for (let box = 0; box < 4; box++) {
    for (let k = 0; k < 256; k += 2) {
      [l, r] = encipher(P, S, l, r);
      S[box * 256 + k] = l;
      S[box * 256 + k + 1] = r;
    }
  }
}

/** Blowfish key schedule seeded with salt: P is XORed with the key while the
 *  mixing pairs are salted - bcrypt's first expandstate call. */
function expandState(
  P: Uint32Array,
  S: Uint32Array,
  salt: Uint8Array,
  key: Uint8Array
): void {
  let j = 0;
  for (let i = 0; i < 18; i++) {
    const [w, nj] = stream2word(key, j);
    P[i] = (P[i] ^ w) >>> 0;
    j = nj;
  }
  let l = 0;
  let r = 0;
  j = 0;
  for (let i = 0; i < 18; i += 2) {
    let w: number;
    [w, j] = stream2word(salt, j);
    l = (l ^ w) >>> 0;
    [w, j] = stream2word(salt, j);
    r = (r ^ w) >>> 0;
    [l, r] = encipher(P, S, l, r);
    P[i] = l;
    P[i + 1] = r;
  }
  for (let box = 0; box < 4; box++) {
    for (let k = 0; k < 256; k += 2) {
      let w: number;
      [w, j] = stream2word(salt, j);
      l = (l ^ w) >>> 0;
      [w, j] = stream2word(salt, j);
      r = (r ^ w) >>> 0;
      [l, r] = encipher(P, S, l, r);
      S[box * 256 + k] = l;
      S[box * 256 + k + 1] = r;
    }
  }
}

/** Encode bytes with bcrypt's Base64 variant (3 bytes -> 4 chars, partial
 *  groups emit 2-3 chars, no padding). */
export function encodeB64(data: Uint8Array): string {
  let out = '';
  for (let i = 0; i < data.length; i += 3) {
    const b0 = data[i];
    const b1 = i + 1 < data.length ? data[i + 1] : -1;
    const b2 = i + 2 < data.length ? data[i + 2] : -1;
    out += B64_CHARS[b0 >> 2];
    out += B64_CHARS[((b0 & 0x03) << 4) | (b1 >= 0 ? b1 >> 4 : 0)];
    if (b1 < 0) break;
    out += B64_CHARS[((b1 & 0x0f) << 2) | (b2 >= 0 ? b2 >> 6 : 0)];
    if (b2 < 0) break;
    out += B64_CHARS[b2 & 0x3f];
  }
  return out;
}

/** Decode bcrypt Base64 into exactly `count` bytes (throws on bad chars or
 *  when the input carries fewer than `count` bytes worth of bits). */
export function decodeB64(input: string, count: number): Uint8Array {
  const out = new Uint8Array(count);
  const totalBits = count * 8;
  let target = 0;
  for (let i = 0; i < input.length && target < totalBits; i++) {
    const c = input.charCodeAt(i);
    const v = c < 128 ? B64_INDEX[c] : -1;
    if (v < 0) throw new Error(`Invalid character in bcrypt base64 data: ${input[i]}`);
    for (let bit = 5; bit >= 0 && target < totalBits; bit--) {
      if (v & (1 << bit)) out[target >> 3] |= 1 << (7 - (target & 7));
      target++;
    }
  }
  if (target < totalBits) throw new Error('Bcrypt base64 data is too short');
  return out;
}

function assertPassword(password: string): void {
  if (typeof password !== 'string') throw new Error('Password must be a string');
  if (password.length === 0) throw new Error('Password must not be empty');
}

/** Validate a cost factor, throwing a clear error outside 4-31. */
export function assertCost(cost: number): void {
  if (!Number.isInteger(cost) || cost < MIN_COST || cost > MAX_COST) {
    throw new Error(`Cost factor must be an integer between ${MIN_COST} and ${MAX_COST}`);
  }
}

/** Yield to the event loop so high costs never freeze the UI thread. */
const nextTick = (): Promise<void> => new Promise((resolve) => setTimeout(resolve, 0));

/**
 * Compute the bcrypt digest of a password with an explicit salt and cost.
 * Shared by hash (fresh random salt) and verify (salt parsed from the hash) -
 * also the deterministic entry point used by the test suite.
 */
export async function bcryptHashWithSalt(
  password: string,
  cost: number,
  salt: Uint8Array
): Promise<string> {
  assertCost(cost);
  if (!(salt instanceof Uint8Array) || salt.length !== 16) {
    throw new Error('Salt must be exactly 16 bytes');
  }
  const key = keyData(password);

  const P = P_INIT.slice();
  const S = S_INIT.slice();
  expandState(P, S, salt, key);
  const rounds = 2 ** cost;
  for (let k = 0; k < rounds; k++) {
    expand0(P, S, key);
    expand0(P, S, salt);
    // Periodically yield so the browser stays responsive at high costs.
    if ((k & 63) === 63) await nextTick();
  }

  const cdata = new Uint32Array(6);
  for (let i = 0; i < 6; i++) {
    cdata[i] =
      (MAGIC.charCodeAt(i * 4) << 24) |
      (MAGIC.charCodeAt(i * 4 + 1) << 16) |
      (MAGIC.charCodeAt(i * 4 + 2) << 8) |
      MAGIC.charCodeAt(i * 4 + 3);
  }
  for (let i = 0; i < 64; i++) {
    for (let j = 0; j < 6; j += 2) {
      const [l, r] = encipher(P, S, cdata[j] >>> 0, cdata[j + 1] >>> 0);
      cdata[j] = l;
      cdata[j + 1] = r;
    }
  }
  const digestBytes = new Uint8Array(23);
  for (let i = 0; i < 23; i++) {
    digestBytes[i] = (cdata[i >> 2] >>> (24 - 8 * (i & 3))) & 0xff;
  }
  return encodeB64(digestBytes);
}

/**
 * Hash a password with bcrypt. Generates a fresh 16-byte crypto-random salt,
 * runs 2^cost EksBlowfish rounds (default cost 12), and returns a `$2b$`
 * hash string. Async so high costs can yield to the event loop.
 */
export async function bcryptHash(password: string, cost: number = DEFAULT_COST): Promise<string> {
  assertPassword(password);
  const salt = new Uint8Array(16);
  crypto.getRandomValues(salt);
  const digest = await bcryptHashWithSalt(password, cost, salt);
  return `$2b$${String(cost).padStart(2, '0')}$${encodeB64(salt)}${digest}`;
}

/**
 * Verify a password against a `$2a$` / `$2b$` / `$2y$` bcrypt hash.
 * Recomputes the digest with the hash's own salt and cost, then compares
 * in constant time. An empty password is allowed here - reference bcrypt
 * implementations can hash the empty string, so their hashes must verify.
 */
export async function bcryptVerify(password: string, hash: string): Promise<boolean> {
  const info = bcryptDecode(hash);
  const salt = decodeB64(info.salt, 16);
  const digest = await bcryptHashWithSalt(password, info.cost, salt);
  const expected = hash.slice(hash.length - 31);
  let diff = 0;
  for (let i = 0; i < digest.length; i++) diff |= digest.charCodeAt(i) ^ expected.charCodeAt(i);
  return diff === 0;
}

/**
 * Parse a bcrypt hash string into its parts: version prefix, cost factor and
 * 22-character Base64 salt. Throws on malformed input.
 */
export function bcryptDecode(hash: string): BcryptInfo {
  if (typeof hash !== 'string') throw new Error('Hash must be a string');
  const m = HASH_RE.exec(hash.trim());
  if (!m) {
    throw new Error('Not a valid bcrypt hash (expected $2a$/$2b$/$2y$CC$ + 53 base64 chars)');
  }
  const cost = Number(m[1]);
  if (cost < MIN_COST || cost > MAX_COST) {
    throw new Error(`Cost factor out of range (${MIN_COST}-${MAX_COST})`);
  }
  return { version: m[0].slice(0, 4), cost, salt: m[2] };
}