Why is the PHP crypt() function returning the same thing for two different strings?

Question

I\'m using PHP\'s crypt function for password hashing/encryption, but I don\'t think I am doing it right because \"nathan12\" and \"nathan123\" both allow me to log

Answer 1

You should use more than just a password salt to encrypt passwords.

You can store a random string in your configuration file.

$config['passwordKey'] = 'asjdfa783#H$Khjsdfhas78a734J%JSDGK2348235hxmfdA';

And append it to $salt when encrypting. This way if the database is compromised, and your file system is not, then attackers can't decrypt your database password hashes. This should be essential to protect the users information on other sites with identical login information.

---

To hash your passwords, password_hash is a simple crypt() wrapper specially configured for password hashing! (source)

$password = password_hash($password, PASSWORD_BCRYPT, array(
    'cost' => 60,
    'salt' => $salt . $config['passwordKey']
));