note 114410 deleted from function.password-hash by cmb
| From: | cmb@php.net | Date: | Sun, 24 May 2020 10:41:34 +0000 |
| Subject: | note 114410 deleted from function.password-hash by cmb | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-214671@lists.php.net to get a copy of this message | ||
Note Submitter: cottton
----
if you thought
"why is the salt included in the hash and is it save when i store it as it is in my db?"
Answer i found:
The salt just has to be unique. It not meant to be a secret.
As mentioned in notes and docu before: let password_hash() take care of the salt.
With the unique salt you force the attacker to crack the hash.
The hash is unique and cannot be found at rainbow tables.