Question

I need to take a user’s email address and somehow manipulate the value to come up with an auto-generated password. I want to make sure that I can re-create the same password whenever a user needs to retrieve their password.

Is there a standard way of doing this? Is this what a “hash” is? I would be greatly appreciative if someone could point me in the right direction! 🙂 Once I know where to look, I can do the research myself.

Thanks!

Sunny

Answer 1

Yes, that’s what a “hash” is. However, I would strongly caution against this approach, because it means that someone who’s good at cryptographic analysis could potentially generate the password for any user on the system, just by knowing their email address.

Standard practice in the case you’re suggesting is to actually reset the user’s password with a new, random password when they forget their password. That keeps their previous password “safe,” so that someone happens to intercept the email with their password, it will only contain a random password rather than a password that the user very likely uses for every other website they log in to.

After a password reset, users should be encouraged to change their password when they first log in.