Re: Security findings

On Sun, Apr 19, 2026 at 07:38:05PM +0200, Alejandro Colomar via Mutt-dev wrote:
> Hmmm, I think crypt prints the hex values as text.  That is, where
> mutt(1) would produce the value 0x1234, crypt would produce the string
> "1234" (more or less).

The crypt(3) function, after generating the hash, outputs it in B64 format,
which is very similar to base64 but confusingly the alphabet is in a different
order (and has dot where base64 has plus).  So yes, the output from crypt(3)
is guaranteed to be ASCII characters.

Ian Collier.