Question

I was looking about best practice for password protect, everybody are talking about bcrypt and others hashing classes. But I can’t get how To verify password if it contains unique random salt .

For cookies its fine, but without em – each time would be unique crypted value, how can I verify users password with random values? Oo . Or bcrypt only for cookies?
Then what I should do with password in db?

Please describe to me my mistakes – what I’ve lost when learning about it.

Answer 1

The bcrypt algorithm creates a random salt that is stored as part of the hash in a standardised way.

See How do you use bcrypt for hashing passwords in PHP? for a working example.

See also:

• Secure hash and salt for PHP passwords

(edited heavily since my answer was wrong before)