How to decrypt hash stored by bcrypt

You’re HASHING, not ENCRYPTING!

What’s the difference?

The difference is that hashing is a one way function, where encryption is a two-way function.

So, how do you ascertain that the password is right?

Therefore, when a user submits a password, you don’t decrypt your stored hash, instead you perform the same bcrypt operation on the user input and compare the hashes. If they’re identical, you accept the authentication.

Should you hash or encrypt passwords?

What you’re doing now — hashing the passwords — is correct. If you were to simply encrypt passwords, a breach of security of your application could allow a malicious user to trivially learn all user passwords. If you hash (or better, salt and hash) passwords, the user needs to crack passwords (which is computationally expensive on bcrypt) to gain that knowledge.

As your users probably use their passwords in more than one place, this will help to protect them.

Related Posts:

  1. “inappropriate ioctl for device”
  2. “inappropriate ioctl for device”
  3. What does “if (1)” do?
  4. How do I use the MOSS script?
  5. Global symbol requires explicit package name
  6. How do I completely mirror a web page?
  7. How to fix a locale setting warning from Perl
  8. PERL API error 500 server closed connection without sending any data back
  9. Find size of an array in Perl
  10. How can I call a shell command in my Perl script?
  11. How to print variables in Perl
  12. What does =~ do in Perl?
  13. Unable to install gem – Failed to build gem native extension – cannot load such file — mkmf (LoadError)
  14. Cannot load such file — bcrypt_ext
  15. Do I need to include #!/usr/bin/perl line in Perl script on Windows?
  16. bcrypt LoadError: Cannot load such file
  17. How can I sort a Perl hash on values and order the keys correspondingly (in two arrays maybe)?
  18. Porting Perl to Python
  19. “End of script output before headers” error in Apache
  20. How to replace a string in an existing file in Perl
  21. What is the meaning of @_ in Perl?
  22. What is the meaning of @_ in Perl?
  23. What is the best way to delete a value from an array in Perl?
  24. How can bcrypt have built-in salts?
  25. The correct way to read a data file into an array
  26. How to use dos2unix?

Leave a Comment