Retrieving password when the password stored as a hash value

Question

Can users request that their password be emailed to themselves if the password is stored as a hash value?

Is there any way to convert a hash value to the clear text

Answer 1

There is no way to reverse the commonly used hashes. They can be bruteforced (trying every single possible password) or you can use a wordlist (using a list of commonly used passwords) in combination to brute force to speed it up some, but it is still a very slow and CPU intensive process.

The best way, which many sites use, it to create a "Password Reset" button where you enter your username and email, and if they match, it sends you a random password and gives you a link to the login page and you can login with your random password and change your password.

Answer 2

Hashed passwords cannot be retrieved in general (this depends on the hashing function, secure hashes cannot be retrieved). If they have the same hash on two sites, they could have the same password, this depends on the hash salt used by the sites, what method etc.

If your password is securely stored in a good hashing system, a provider should never be able to email you your password, you must reset your password if you forget it.

Answer 3

In short, no. With most hashing algorithms, you can have multiple inputs with the same output. It is often better to offer a password reset option.

Answer 4

To do this you must have a model with the fields:

Hashed_password
Salt

And you need to know the method user to hash the password( Here I use SHA1) Then you can define in your controller:

def self.encrypted_password(password, salt)
   string_to_hash = password + "wibble" + salt
   Digest::SHA1.hexdigest(string_to_hash)
end

Next you can compare:

user.Hashed_password == encrypted_password(password, user.salt)

True means that "password" is the password for the user "user"

Answer 5

If you're only storing a hash of the password, then no. ...and you should only be storing a properly-salted hash of their password, anyway.

Password reset mechanisms are the proper alternative.

Answer 6

There are different types of hashing algorithms. Some are more secure than others. MD5 is a popular, but insecure one. The SHA-family is another more secure set of algorithms.

By definition, a hash is a one way function. It can not be reversed.

http://en.wikipedia.org/wiki/Sha-1