new user here. I've tried searching for an answer but I don't think I know the correct terms to search for. I've tried things like "bcrypt same password different hash" but can't find an answer to my question below.
Preamble: From what I have searched online, bcrypt returns the hashpw function with a byte-type string concatenation of the salt appended with the actual hash(salt+password).
My Question: Why does bcrypt recognize it as a password match when I provide it with another generated hash from the website https://bcrypt-generator.com? What is bcrypt.checkpw() actually comparing?
If I were to check if the user's input matches the salt+hash on the server, how should I do it? bcrypt provides a different salt+hash every time the function runs, and apparently salt1+hash1 matches salt2+hash2 when generated from the same string. I'm really confused with how this works.
import bcrypt # import public crypto hash function bcrypt import time from datetime import datetime password = b"test password" # convert password from string type to bytes type i = 13 # work factor to determine computation time start = datetime.fromtimestamp(time.time()) # mark computation start time salt = bcrypt.gensalt(i) end = datetime.fromtimestamp(time.time()) # mark computation end time hashSPW = bcrypt.hashpw(password, salt) print("Start: ", start) print("End: ", end) print("Duration: ", end-start) # print duration print("Salt: ", salt) print("HashSPW: ", hashSPW) user_input = b"test password" # change input here to test #if bcrypt.checkpw(user_input, hashSPW): if bcrypt.checkpw(user_input, b"$2y$13$iynZoPYY5DL3TjnAJkOcbevq0QJBfDPMShN27aSG5wzL7MaRza.Sa"): # value got from https://bcrypt-generator.com/ print("Password Matched!") else: print("Password Does Not Match!")