Home/ Questions/Q 7005085
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-27T21:18:26+00:00

My co-workers are using a commercial program that encodes and stores login passwords on

  • 0

My co-workers are using a commercial program that encodes and stores login passwords on some database.

Now, I’m developing another program to achieve some other tasks, but I want my co-workers to authenticate to this program with their same username and passwords to avoid confusion.

The problem is, I don’t have (and probably never will) any source code to determine which encryption algorithm they’ve used.
I ran some tests and observed that same passwords always produces same hashcodes with 24 characters in length. For example;

1         XeVTgalUq/gJxHtsMjMH5Q== 

123456    0Q8UhOcqClGBxpqzooeFXQ==

Is there any way to determine which algorithm they’ve used ?
Thanks in advance,

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Nope. That is the point of encryption / hashing– it is supposed to be opaque so that it should not be easy to reverse engineer. The only thing you can do is try a few well-known hash algorithms like SHA-1 and see if the hash values match the other program. But, there’s no way to know if the other program added in any “salt” or is hashing together multiple things, e.g. username + password or some other scheme. So you are probably out of luck on that front.

    One idea you could try with your new program: if the user has never logged in before, allow them to log in the first time with ANY password. Tell the users that they should use the same password they did with the other program. Then, when they log in, capture that value and hash it using your own hashing scheme, then store that for future logins. So ultimately you would get the result you’re aiming for (that users can use their same passwords), without having to reverse engineer the encryption scheme of the other program.

    Now, clearly the drawback with this approach is that it is not secure at all for the first login. Someone could hijack another user’s account if they logged in as that user before the real user had a chance to log in for the first time (and thereby lock in his password). So this is only an option if there is no sensitive data pre-loaded in the new program that could be compromised. Also you would need the ability for an administrator to reset a users’ password so that if this kind of thing did happen, you could correct it easily when the real user reports that they can’t log in.

    • 0