Let's say that you have a table where you'll store the password for each person.

To "save" the password that's being generated, do the following

1. get the login from the user
2. get the password
3. generate some salt from random values. Let's say, from /dev/random (as @Michal suggested), you got "a12bc34de56fg"
4. Use some hashing function to generate the hashed password. Let's say the original password was "1password" and you'll use any SHA hashing. You'll do

hashed_password = SHA(SHA(SHA(.... SHA("1passworda12bc34de56fg"))))))))

Store that hashed_password, with the login and the salt, in the table.

login      password      salt
--------------------------------------
john       a7b82783...   a12bc34de56fg

And then, to verify when a user access your app:

1. get the login and the password
2. retrieve the salt for that login from the database (you'll have the salt: a12bc34de56fg)
3. concatenate the plain-text-password with the salt and do all the hashing again:

hashed_password = SHA(SHA(SHA(.... SHA("1passworda12bc34de56fg"))))))))

Verify if the hashed_password that you calculated is the same that was stored in the database. You'll know if the password was correct or not.

That's it!. You can get the salt from any random source you like. Why should it be random? Because any non-random salt would make it much easier to to attempt to brute-force the your app.

Let's say that you have a table where you'll store the password for each person.

To "save" the password that's being generated, do the following

1. get the login from the user
2. get the password
3. generate some salt from random values. Let's say, from /dev/random (as @Michal suggested), you got "a12bc34de56fg"
4. Use some hashing function to generate the hashed password. Let's say the original password was "1password" and you'll use any SHA hashing. You'll do

hashed_password = SHA(SHA(SHA(.... SHA("1passworda12bc34de56fg"))))))))

Store that hashed_password, with the login and the salt, in the table.

login      password      salt
--------------------------------------
john       a7b82783...   a12bc34de56fg

And then, to verify when a user access your app:

1. get the login and the password
2. retrieve the salt for that login from the database (you'll have the salt: a12bc34de56fg)
3. concatenate the plain-text-password with the salt and do all the hashing again:

hashed_password = SHA(SHA(SHA(.... SHA("1passworda12bc34de56fg"))))))))

Verify if the hashed_password that you calculated is the same that was stored in the database. You'll know if the password was correct or not.

That's it!. You can get the salt from any random source you like. Why should it be random? Because any non-random salt would make it much easier to to attempt to brute-force your app.

Let's say that you have a table where you'll store the password for each person.

To "save" the password that's being generated, do the following

1. get the login from the user
2. get the password
3. generate some salt from random values. Let's say, from /dev/random (as @Michal suggested), you got "a12bc34de56fg"
4. Use some hasing function to generate the hashed password. Let's say the original password was "1password" and you'll use any SHA hashing. You'll do

hashed_password = SHA(SHA(SHA(.... SHA("1passworda12bc34de56fg"))))))))

Store that hashed_password, with the login and the salt, in the table.

login      password      salt
--------------------------------------
john       a7b82783...   a12bc34de56fg

And then, to verify when a user access your app:

1. get the login and the password
2. retrieve the salt for that login from the database (you'll have the salt: a12bc34de56fg)
3. concatenate the plain-text-password with the salt and do all the hashing again:

hashed_password = SHA(SHA(SHA(.... SHA("1passworda12bc34de56fg"))))))))

Verify if the hashed_password that you calculated is the same that was stored in the database. You'll know if the password was correct or not.

That's it :). And you can get the salt from any random source you like. And why random? Because it would be easier to brute-force your app if you know what the salt was.

Let's say that you have a table where you'll store the password for each person.

To "save" the password that's being generated, do the following

1. get the login from the user
2. get the password
3. generate some salt from random values. Let's say, from /dev/random (as @Michal suggested), you got "a12bc34de56fg"
4. Use some hashing function to generate the hashed password. Let's say the original password was "1password" and you'll use any SHA hashing. You'll do

hashed_password = SHA(SHA(SHA(.... SHA("1passworda12bc34de56fg"))))))))

Store that hashed_password, with the login and the salt, in the table.

login      password      salt
--------------------------------------
john       a7b82783...   a12bc34de56fg

And then, to verify when a user access your app:

1. get the login and the password
2. retrieve the salt for that login from the database (you'll have the salt: a12bc34de56fg)
3. concatenate the plain-text-password with the salt and do all the hashing again:

hashed_password = SHA(SHA(SHA(.... SHA("1passworda12bc34de56fg"))))))))

Verify if the hashed_password that you calculated is the same that was stored in the database. You'll know if the password was correct or not.

That's it!. You can get the salt from any random source you like. Why should it be random? Because any non-random salt would make it much easier to to attempt to brute-force the your app.