note 129101 added to function.password-verify

Imagine you are using an API between servers (where the password is stored in the API server) and you want to avoid passing the password in plain text via the API, or sending the full hash to the API client. You can just receive the original salt and re-crypt the password on the API client, then you can send the recrypted password to the API server to compare them. <?php define('BLOWFISH_SALT_LENGTH', 23); $pass = 'maduranma'; $original = password_hash($pass, PASSWORD_DEFAULT); // Equivalent to PASSWORD_BCRYPT $salt = substr($original, 0, strrpos($original, '$') + BLOWFISH_SALT_LENGTH); $recrypted = crypt($pass, $salt); // This can be done on the API client and sent to the API server // So we can compare both: var_dump($original === $recrypted); // Returns true, should be done on the API server ---- Server IP: 45.112.84.4 Probable Submitter: 45.91.157.134 (proxied: 95.39.143.96) ---- Manual Page -- https://php.net/manual/en/function.password-verify.php Edit -- https://main.php.net/note/edit/129101 Del: integrated -- https://main.php.net/note/delete/129101/integrated Del: useless -- https://main.php.net/note/delete/129101/useless Del: bad code -- https://main.php.net/note/delete/129101/bad+code Del: spam -- https://main.php.net/note/delete/129101/spam Del: non-english -- https://main.php.net/note/delete/129101/non-english Del: in docs -- https://main.php.net/note/delete/129101/in+docs Del: other reasons-- https://main.php.net/note/delete/129101 Reject -- https://main.php.net/note/reject/129101 Search -- https://main.php.net/manage/user-notes.php