Question

I am trying to hash a password and save it in the database; I know hashing is a one way process. How can I check whether the user supplied password and the one stored in the database are same? I am using MD5 and I am getting different values for the same input when I perform hashing each time. Can anyone help?

String pass = "wor1ldcup";
    String pass1 = "wor1ldcup";

    DigestUtils du = new DigestUtils();
    byte[] b = du.md5(pass);
    byte[] b1 = du.md5(pass1);

Answer 1

The code you supplied is basically correct, with a couple of caveats:

1. The methods of DigestUtils are all static, and hence should be invoked as:

   byte[] b = DigestUtils.md5(...);
   

   and not as

   DigestUtils du = new DigestUtils();  // wrong ... no need to instantiate
   byte[] b = du.md5(...);              // wrong ... never use an instance to
                                        //           call a static method.
   

2. You don’t show how you compare the b and b1, but b == b1 won’t work, and neither will b.equals(b2) … both compare references. You need to call Arrays.equals(b, b1).

3. It is a bad idea to try to turn an MD5 hash into a String. Depending on the default character set, the conversion may turn out to be lossy; i.e. not reversible. If you want to store an MD5 hash in a database, it is better to encode as a String using (for example) base64 encoding, and save the encoded hash.