Question

I have stored user passwords in an encrypted format in my database. However, now when user wants to login and tries to put their original password the code always compares the entered (original) password with the encrypted version stored in the database, leading to a failed login.

Please tell me how to compare the entered (original) password with the encrypted password stored in the database.

Answer 1

You should almost certainly be hashing the password rather than using reversible encryption. You may need to do this with a salt too… in which case the correct steps are:

• Find the salt that was used when originally hashing the password (this will generally be stored with the hashed password).
• Hash the password entered by the user using that salt.
• Compare the two hashes – if they’re equal, the user (almost certainly) entered the right password.

Note the difference between the when you store the hashed password to start with, when you generate a random salt, and when you verify the stored hash, when you use the stored salt.