This thread is permanently archived
hoe password salting works?
| how*
| Why would you store the salt as a field in a database? That defeats the entire point of salting to begin with.
| how would you match the password then?
| It's to prevent users' original passwords from being compromised in the event of a breach. And to prevent rainbow table attacks
| >>80237
What PHP's built-in functions do is put the salt (and length of the salt as a decimal number) at the start of the hash.
When comparing hashes, it splits that up into the hash and the salt, combines the input password with the salt, hashes it, and compares the hashes.
| So in the "password" field in the database it stores something like this:
(salt)(hash of (salt . password))
Then to compare you check if (salt . input password) matches the hash in the password field.
You can also put the salt in a separate database field as long as you still do hash(salt+password) for both setting and checking the password.
It is recommended to generate a new cryptographically secure random salt of at least 11 characters when changing the password.
| Huh
| mad sus
| well so it works like i imagined it to be, but now i'm just confused by the first comment
This thread is permanently archived
| do i store the salt as another field in the database?