Skip to content

hash-password

Produces a bcrypt hash for use with the mobile-app command's locked mode. Operators set the resulting hash in the TOURNAMENT_PASSWORD_HASH environment variable so the running server can compare incoming X-Tournament-Password headers against it without storing the plaintext.

bracket-creator hash-password [plaintext]

Input

The command reads the plaintext from one of two sources, in this order:

  1. Positional argument: bracket-creator hash-password mysecret. Convenient for ad-hoc use, but the password is recorded in shell history. Suitable for development.
  2. Standard input (when no argument is supplied): read one line of stdin. The terminal echoes what the operator types. The command does not disable echo or print a prompt. For production rotation, pipe from a secrets manager or here-doc rather than typing the password interactively. Recommended path because it avoids shell-history leakage.

Bcrypt has a hard 72-byte limit on the input. Passwords longer than that are rejected up-front rather than silently truncated.

Output

Single line on stdout: the bcrypt hash (for example, $2a$10$tq9jkGYsf1ttx0ZM.UUrxezVBcO4aZaS.dVRY73xC5lwEvTJLcMc6). Cost is bcrypt.DefaultCost (10), fine for admin-facing endpoints (~50-100 ms per verify) and not worth tuning until a real load problem appears.

Examples

Pass the password as an argument:

bracket-creator hash-password mysecret

Pipe it from another command:

echo -n "$MY_SECRET" | bracket-creator hash-password

Capture the hash into a shell variable and start the tournament app in locked mode:

HASH=$(printf '%s' "$MY_SECRET" | bracket-creator hash-password)
TOURNAMENT_PASSWORD_HASH="$HASH" \
  bracket-creator mobile-app --lock-password -f ./tournament-data

Refer to the mobile-app command reference for how the hash is consumed at startup.