Hacker News Reader

Uh? Of course not. It will spit out exactly the same hash every time, given the same input.

How else would you verify that the password matches ?

Try it, it doesn't. The Bcrypt algorithm generates salts and the salt is built into the outputted hash.

I don't know. Laravel uses a hash algorithm that uses bcrypt and never outputs the same hash.

Bcrypt uses 22 character salt.

The output of your library's BcryptEncoder.encode(password) includes not only the password hash but information about the algorithm and the salt. That's what you store in your database. That extra information tells the decode function how to decode later on.

See here:

http://stackoverflow.com/questions/6832445/how-can-bcrypt-ha...

Reply on news.ycombinator.com