How to re-hash Laravel passwords?

问题:

I'm making a forget password feature in my web app, problem is I store user's password using:

Hash::make('_their_password_')

Is there any way to re-hash it back or any recommended approach for this?

回答1:

The point of hashing a password is that it's (supposed to be) an irreversible operation. If your database is compromised, the attacker will gain access to the hashes, but not to the passwords. That way the attacker can't log in with the users' passwords on other sites.

Make a "we'll reset your password" feature instead of a "we'll send you your password" feature.

Note that there are also other best practices you absolutely should be following regarding password hashing, to make sure the "supposed to be" above actually holds, and to further minimize the impact if your site is compromised. Laravel's Hash class seems to already be using the password-appropriate hash function Bcrypt. However, make sure you're using a salt when you're hashing your password.

回答2:

The Laravel's Hash method cannot be reversed.

One way encryption is the best way to store user passwords, or other sensitive data.

One way means that your data can be converted into an encrypted string, but due to a complex algorithm with painful maths, reversing the process is not possible. This makes storing passwords a doddle! Your customers don't have to worry about you knowing their passwords, but you are still able to compare them (by hashing the password they provide) or change the password if needed.

If you need to reverse, you can use Crypter class.

$secret = Crypter::encrypt('I actually like Hello Kitty');
$decrypted_secret = Crypter::decrypt($secret);

Read more about encryption here http://codehappy.daylerees.com/encryption