1.6.0

Changed

• BCryptFunction, SCryptFunction, #withBCrypt(), #withSCrypt(), getBCryptInstance(), getSCryptInstance() to BcryptFunction, ScryptFunction, #withBcrypt(), #withScrypt(), getBcryptInstance(), getScryptInstance() (#36).

Fixed

• Scrypt never prepends $s0 to the result (#64).

1.5.4

Fixed

• Removed slf4j-nop which can cause issues if not excluded from the dependency tree (#46

1.5.3

Fixed

• byte[] are converted to String with environment-based encoding instead of UTF-8 (#35 and #16).

1.5.2

Changed

• Raised the compatibility with Android API level from 26+ (Android 8.0) to 21+ (Android 5.0).
• SystemChecker's benchmark tools returns a prototype of the function and the real elapsed time (#23)

Fixed

• Argon2 was not using the given pepper with Password.check(String, Hash).
• Salt was converted from String to byte[] too many times. (#31).

Removed

• Dependency with Apache Commons Text.

1.5.1

Added

• Hash stores the byte array containing the calculated hash without algorithm's parameters and salt (#26)

Changed

• Scrypt accepts dynamic key length (#24)

Fixed

• Improved toString() methods' readability.

1.5.0

Added

• Argon2 support

Changed

• Enums BCrypt and Hmac are moved from com.password4j to com.password4j.types

Fixed

• Some typos along the code.

1.4.0

Added

• CHFs like MD5, SHA-1, SHA-2 and SHA-3 in order to increase compatibility with legacy systems.

Changed

• PBKDF2Function.getAlgorithm() returns a String instead of an Hmac enum. This make PBKDF2Function.toString() and CompressedPBKDF2Function.toString() more readable.
• SystemChecker.isPBKDF2Supported() accepts a String instead of an Hmac enum.

Fixed

• Some typos along the code.

1.3.2

Fixed

• The location of the configuration file is now customizable (#5)

Security

• SecureString.toString() now hides the length of the string (#6)

1.3.1

Fixed

• toString() of some HashingFunction produced non-unique output (#3)
• added missing getters for some HashingFunctions (#4)

1.3.0

Added

• Capability of updating the hash (re-hash) with a new configuration just after the verification process

Changed

• HashBuilder and HashChecker are less extendable because there are more maintainability issues than effective advantages
• Pepper can be provided either with SecureString or String.

Removed

• Password.hash() and Password.check() methods that accepts a custom HashBuilder or a custom HashChecker