4 ms·
Just noting if you're new to this you don't have to add a salt, by default password_hash with bcrypt will add a random one to each password.
by showerst 13y ago
Just noting if you're new to this you don't have to add a salt, by default password_hash with bcrypt will add a random one to each password.
- nly 13y agoAssuming the RNG isn't duff, which PHP has stumbled on a few times in the past, with session keys and such.
- ircmaxell 13y agoCheck it out for yourself. Here's the random generating parts, pulled out for you: http://stackoverflow.com/questions/14673005/how-does-phps-password-hash-generate-the-salt http://stackoverflow.com/questions/14673005/how-does-phps-pa...
- lukeschlather 13y agoHow does that work? Don't you need the original salt to verify the hash?
- eterm 13y agoThe salt is stored in the hash itself, so it can extract the salt from any provided hash. (Neat huh?)
- pjscott 13y agoHere's a quick explanation of the format, in case anybody's interested: http://pythonhosted.org/passlib/lib/passlib.hash.bcrypt.html#format-algorithm http://pythonhosted.org/passlib/lib/passlib.hash.bcrypt.html...