Getting password hash from MySQL

Question

I am generating a password in PHP as follows:

$options = [
    'cost' => 11,
];
// Get the password from post
$passwordFromPost = $_POST['password'];

$hash = password_hash($passwordFromPost, PASSWORD_BCRYPT, $options);

and I insert it in a MySQL table.

Now, I would like to retrieve it. I was using a hash+salt password, but I would like to remove the salt option. How could I retrieve the created password in PHP?

A simple SELECT hash FROM table query should fetch it. You shouldn't be mucking around with the automatic salts. I feel like I'm missing something in your question. — ceejayoz
– ceejayoz, Commented Jun 9, 2017 at 18:04
You can't get the password back, if that's what you're asking -- hashes are one-way. Use password_verify() to check if user-supplied input matches your stored value. — Alex Howansky
– Alex Howansky, Commented Jun 9, 2017 at 18:04
You want to un-salt a hashed password? You can't. That's the whole point of using salted hashes. If you can do it, so can potential attackers. — rickdenhaan
– rickdenhaan, Commented Jun 9, 2017 at 18:04
You very badly need to do some research on how to properly store passwords. You're operating under some dangerous misconceptions that need to be fixed before you continue. No, I won't listen them, because I doubt I could catch them all, and if I gave you an incompetent checklist, that could just be worse, because now you think you know all the pitfalls. Instead, find a detailed guide on how to do it, and Google for any reasoning that isn't explained in the article. — anon
– anon, Commented Jun 9, 2017 at 18:14

avisheks · Accepted Answer · 2017-06-09 18:31:30Z

Ok, here it goes. You cannot retrieve the raw passwords again as hash(hash+salt) being the one way encryption technique(and that makes sense one should not be able to read anybody's raw password and misuse). The way it work is, when user type in their passphrase to login, the same encryption algorithm(that's been followed while storing) being followed to create the hash out of it. The comparison now happens between hash to hash to get a valid session token.

Now, coming to the question if you want to change the encryption algorithm or the salt, you need to allow user to login with the old encryption algo. What you should be doing is to gradual migration of old user's password hash to new password hash. And the only option you get the raw pass is when user type them in. You need to identify if they are the old users, if they are allow them log-in with backward compatible algorithm and silently update their password with encrypted with the new salt.

Mm-Art-In · Accepted Answer · 2017-06-09 18:33:53Z

0

You can't retrieve the plaintext password.

But If in your case the web site is up and people are using it, you can add a function after password verify to update user's password in the database using your new hash. You might be able to know which passords are updated by simply adding a field in your database to tell you.

edited Jun 9, 2017 at 18:33

Mm-Art-In

23k13 gold badges81 silver badges144 bronze badges

answered Jun 9, 2017 at 18:12

Mohamed Hesham

1573 bronze badges

1 Comment

Mm-Art-In Over a year ago

it is not "unfortunate" that you can't retrieve plaintext passwords. It's intended.

Collectives™ on Stack Overflow

Getting password hash from MySQL

2 Answers 2

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related