Decrypting a devise password

问题:

I need to decrypt a password generated by devise.

For example, my password is test123test. devise generated this password:

$2a$10$vGeVVu.E0XGjlNEa0xMCK.R0SEH0aFuyJpefrq01Axz6WSbHApPEu 

I need to decrypt the password and send test123test.

回答1:

You can't, that's the whole point.

Bcrypt will allow you compare test123test with $2a$10$vGeVVu.E0XGjlNEa0xMCK.R0SEH0aFuyJpefrq01Axz6WSbHApPEu, but it will never give you the plain text password back. You might want to ask how to crack a bcrypt encrypted password instead (Very hard! Nearly impossible I think)

Jose Valim describes the motivation behind choosing bcrypt by linking to http://codahale.com/how-to-safely-store-a-password/ from the devise Google Group.

回答2:

Use the recoverable module in Devise to reset the user's password.

devise :database_authenticatable, :registerable, :token_authenticatable,
     :recoverable, :timeoutable, :trackable, :validatable, :rememberable

Devise will generate a password reset form and will send the user an email with the password reset link. The user clicks on the link, resets their password and signs in again.

回答3:

What Leito said is right. You cannot get plain text password back or may take long long time to find. One other thing is you can check whether given password equals to encrypted one by bcrypt-calculator.

bcrypt-calculator

a.Look for BCrypt Tester

b.enter the password you want to check ex : test123test

c.enter the devise encrypted password ex : $2a$10$vGeVVu.E0XGjlNEa0xMCK.R0SEH0aFuyJpefrq01Axz6WSbHApPEu

press calculate.To find Password and hash match