check that it's a string of the right form (e.g. it repeats something exactly twice) and then derive the original password from that, before feeding it to your

check that it's a string of the right form (e.g. it repeats something exactly twice) and then derive the original password from that, before feeding it to your hashing function.