@Override
    public boolean doCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) {

        PasswordService service = ensurePasswordService();

        Object submittedPassword = getSubmittedPassword(token);
        Object storedCredentials = getStoredPassword(info);
        assertStoredCredentialsType(storedCredentials);

        if (storedCredentials instanceof Hash) {
            Hash hashedPassword = (Hash) storedCredentials;
            return hashedPassword.matchesPassword(ByteSource.Util.bytes(submittedPassword));
        }
        //otherwise they are a String (asserted in the 'assertStoredCredentialsType' method call above):
        String formatted = (String) storedCredentials;
        return service.passwordsMatch(submittedPassword, formatted);
    }
A {@link CredentialsMatcher} that employs best-practices comparisons for hashed text passwords.
<p/>
This implementation delegates to an internal {@link PasswordService} to perform the actual password
comparison.  This class is essentially a bridge between the generic CredentialsMatcher interface and the
more specific {@code PasswordService} component.

@since 1.2
core/src/main/java/org/apache/shiro/authc/credential/PasswordMatcher.java