Skip to content
Advertisement

How should i check hashed passwords

I use crypt ( password , $2y$10$predefinedsalt) to generate hashes.. Is it okay to just check them with other hashes using a normal if?

JavaScript

Advertisement

Answer

Yeah that’s pretty much how password verification works.

You store the original password hashed and on login you hash the entered password with the same options/hash and compare it to the one you’ve stored earlier

PHP recommends using hash_equals() to mitigate timing attacks. Like this:

JavaScript
User contributions licensed under: CC BY-SA
5 People found this is helpful
Advertisement