How do you verify a password with PHP/MySQL using BCRYPT

Question

I don't understand how this works

$hash = $bcrypt->hash($_POST['password']); //this string is stored in mysql

Then when a user logs in,

//get hash string from above from mysql, then

if ($bcrypt->verify($_POST['password'], $row['password'])) {
   echo "Logged in.";
}

A.) Am I doing this correctly?

B.) If so, how does bcrypt remember the salt if it's not stored in the database?

Andrew Leap · Accepted Answer · 2012-10-04 00:28:53Z

1

The salt is prepended to the hash, and so the the function pulls the salt out of the hash from the database. This is why you have to pass the hash from the database to the verification function, instead of just rehashing the password and comparing them.

And yeah, it does look like you are doing it correctly.

answered Oct 4, 2012 at 0:28

Andrew Leap

9564 silver badges9 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

How do you verify a password with PHP/MySQL using BCRYPT

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related