note 112098 deleted from function.password-hash by thiago
| From: | thiago@php.net | Date: | Fri, 03 May 2013 01:57:53 +0000 |
| Subject: | note 112098 deleted from function.password-hash by thiago | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-194694@lists.php.net to get a copy of this message | ||
Note Submitter: Chad Cloman
----
Based on what I know of salting, I was wondering why I would want the function to generate a random
salt without telling me what it was. After all, wouldn't I need the salt later when verifying a
password?
Turns out that isn't the case. The salt is included in the password_hash() return value and is
automatically extracted by the password_verify() function. So it's not necessary to keep track
of the salt value or store it separately.