patrickfav / bcrypt

A Java standalone implementation of the bcrypt password hash function. Based on the Blowfish cipher it is the default password hash algorithm for OpenBSD and other systems including some Linux distributions. Includes a CLI Tool.
https://favr.dev/opensource/bcrypt
Apache License 2.0
467 stars 50 forks source link

Why is verify() needed? #68

Closed Osiris-Team closed 7 months ago

Osiris-Team commented 7 months ago

I want to be able to compare the given password via an SQL statement instead of fetching all users and using the verify function on each password, but it seems that its not possible, the passwords don't match up, why?

I am running encode() on the given password and then use it in the SQL statement with fetches the user where the email and password are the same as the given ones.

I assume it generates a different hash for the same password each time?

Figured this is no problem since the email is unique and thus only one comparison is done.