# Salted and hashed passwords

**URL:** <https://forum.getkirby.com/t/salted-and-hashed-passwords/5289>\
**Category:** Questions\
**Tags:** v2\
**Created:** [September 19, 2016, 1:55pm UTC](https://forum.getkirby.com/t/salted-and-hashed-passwords/5289 "2016-09-19T13:55:13Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![designbuedchen](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/designbuedchen/32/3137_2.png) [@designbuedchen](https://forum.getkirby.com/u/designbuedchen)\
**Post date:** [September 19, 2016, 1:55pm UTC](https://forum.getkirby.com/t/salted-and-hashed-passwords/5289/1 "2016-09-19T13:55:13Z")

</div>

Hi there.

Is there a reason why kirby is not working with salted passwords? Or did I miss this in the code? I like the way wordpress is working with salts, is there a possibility to implement something like this in kirby?

Thanks in advance for your answers!

Regards,  
Patrick

---

<div class="post-metadata">

**Author:** ![PaulMorel](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/paulmorel/32/371_2.png) [@PaulMorel](https://forum.getkirby.com/u/PaulMorel)\
**Post date:** [September 19, 2016, 2:03pm UTC](https://forum.getkirby.com/t/salted-and-hashed-passwords/5289/2 "2016-09-19T14:03:58Z")

</div>

IIRC Kirby salts and hashes passwords using the blowfish cipher when creating and updating users with the `Password` class in the toolkit. The salt is randomly generated.

I’m not really sure if this answers your question.

---

<div class="post-metadata">

**Author:** ![texnixe](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/texnixe/32/5754_2.png) [@texnixe](https://forum.getkirby.com/u/texnixe)\
**Post date:** [September 19, 2016, 2:06pm UTC](https://forum.getkirby.com/t/salted-and-hashed-passwords/5289/3 "2016-09-19T14:06:03Z")

</div>

```auto
public static function hash($plaintext) {
    $salt = substr(str_replace('+', '.', base64_encode(sha1(str::random(), true))), 0, 22);
    return crypt($plaintext, '$2a$10$' . $salt);
  }

```

---

<div class="post-metadata">

**Author:** ![designbuedchen](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/designbuedchen/32/3137_2.png) [@designbuedchen](https://forum.getkirby.com/u/designbuedchen)\
**Post date:** [September 19, 2016, 2:14pm UTC](https://forum.getkirby.com/t/salted-and-hashed-passwords/5289/4 "2016-09-19T14:14:36Z")

</div>

Ok, thanks for copying the function. Indeed I missed this one in the code.

So, for my understanding:

$plaintext is the input of the plain password and gets combined with the salt and both gets hashed by the natural php function crypt ([http://php.net/manual/en/function.crypt.php](http://php.net/manual/en/function.crypt.php)).

This function will be fired when a new user is created or gets updated.

Correct?

---

<div class="post-metadata">

**Author:** ![texnixe](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/texnixe/32/5754_2.png) [@texnixe](https://forum.getkirby.com/u/texnixe)\
**Post date:** [September 19, 2016, 2:16pm UTC](https://forum.getkirby.com/t/salted-and-hashed-passwords/5289/5 "2016-09-19T14:16:36Z")

</div>

Exactly 🙂 (and some more characters)

---

<div class="post-metadata">

**Author:** ![designbuedchen](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/designbuedchen/32/3137_2.png) [@designbuedchen](https://forum.getkirby.com/u/designbuedchen)\
**Post date:** [September 19, 2016, 2:25pm UTC](https://forum.getkirby.com/t/salted-and-hashed-passwords/5289/6 "2016-09-19T14:25:18Z")

</div>

Ok, so now here comes my stupid question:

For the login process the system needs to build the same crypted code again from the plain input to compare the stored key with the login created key. I’m a little bit confused how the login can compare a randomized key?

---

<div class="post-metadata">

**Author:** ![texnixe](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/texnixe/32/5754_2.png) [@texnixe](https://forum.getkirby.com/u/texnixe)\
**Post date:** [September 19, 2016, 2:38pm UTC](https://forum.getkirby.com/t/salted-and-hashed-passwords/5289/7 "2016-09-19T14:38:50Z")

</div>

If you hash a password both when it is first created and then again if it is entered for login purposes, the result will always be the same (this is called “deterministic”).

---

<div class="post-metadata">

**Author:** ![designbuedchen](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/designbuedchen/32/3137_2.png) [@designbuedchen](https://forum.getkirby.com/u/designbuedchen)\
**Post date:** [September 19, 2016, 2:42pm UTC](https://forum.getkirby.com/t/salted-and-hashed-passwords/5289/8 "2016-09-19T14:42:48Z")

</div>

Alright, thanks for your answers! (and patience 🙂)

---

<div class="post-metadata">

**Author:** ![distantnative](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/distantnative/32/11319_2.png) [@distantnative](https://forum.getkirby.com/u/distantnative)\
**Post date:** [February 6, 2025, 4:55pm UTC](https://forum.getkirby.com/t/salted-and-hashed-passwords/5289/9 "2025-02-06T16:55:16Z")

</div>