title: Java: Is this good use of BCrypt?
body: <p>I would like to know if my current implementation of BCrypt is correct, I am aware that I am not using <code>BCrypt.checkpw()</code> which may lead to an issue so that is the main reason I verify it here.</p>
  
  <p>Hasher.java container class:</p>
  
  <pre><code>abstract public class Hasher {
      public static String hash(final char[] input) {   
          String output = Hasher.hash(new String(input));
          for (int i = 0; i &lt; input.length; i++) {
              input[i] = 0;
          }
          return output;
      }
  
      public static String hash(final String input) {
          return BCrypt.hashpw(input, BCrypt.gensalt());
      }
  }
  </code></pre>
  
  <p>One concern here: <code>JPasswordField</code> gives me a <code>char[]</code> for security reasons, however <code>BCrypt.hashpw()</code> only accepts Strings. How can I avoid that String from floating around in my memory?</p>
  
  <p>The client implementation of logging in:</p>
  
  <pre><code>String hashedPassword = Hasher.hash(password);
  Network.getInstance().send("login " + username + " " + hashedPassword);
  </code></pre>
  
  <p>So the hash gets sent over the network, currently the network is not encrypted but I plan on adding that.</p>
  
  <p>The server implementation on account creation:</p>
  
  <pre><code>public static Account createAccount(final String username, final String password) {
      String hashedPassword = Hasher.hash(password.toCharArray());
      return new Account(username, hashedPassword);
  }
  </code></pre>
  
  <p>The server implementation of checking password:</p>
  
  <pre><code>public boolean checkPassword(final String hashedPassword) {
      return this.hashedPassword.equals(hashedPassword);
  }
  </code></pre>
  
  <p>With <code>this.hashedPassword</code> being the hash that is in the server's memory (which comes from a database on bootup).</p>
  
  <p>Properties of my setup:</p>
  
  <ul>
  <li>Logging in takes the client significant time, as the password is hashed there.</li>
  <li>Creating an account/Changing password takes the server significant time, as the password is hashed on the server then.</li>
  <li>Validating login attempts takes the server practically no time, as no hashing needs to be done.</li>
  <li>If someone gets hold of the database containing the hashes, then it will take him significant time to crack the password per account.</li>
  <li>I still need to figure out a good work factor for the <code>BCrypt.gensalt()</code>.</li>
  </ul>
  
  <p>Please verify my assumptions.</p>
  
  <p>Regards.</p>