private void assertStoredCredentialsType(Object credentials) {
        if (credentials instanceof String || credentials instanceof Hash) {
            return;
        }

        String msg = "Stored account credentials are expected to be either a "
                + Hash.class.getName() + " instance or a formatted hash String.";
        throw new IllegalArgumentException(msg);
    }
A {@link CredentialsMatcher} that employs best-practices comparisons for hashed text passwords.
<p/>
This implementation delegates to an internal {@link PasswordService} to perform the actual password
comparison.  This class is essentially a bridge between the generic CredentialsMatcher interface and the
more specific {@code PasswordService} component.

@since 1.2
core/src/main/java/org/apache/shiro/authc/credential/PasswordMatcher.java