new user here. I've tried searching for an answer but I don't think I know the correct terms to search for. I've tried things like "bcrypt same password different hash" but can't find an answer to my question below.

Preamble: From what I have searched online, bcrypt returns the hashpw function with a byte-type string concatenation of the salt appended with the actual hash(salt+password).

My Question: Why does bcrypt recognize it as a password match when I provide it with another generated hash from the website https://bcrypt-generator.com? What is bcrypt.checkpw() actually comparing?

If I were to check if the user's input matches the salt+hash on the server, how should I do it? bcrypt provides a different salt+hash every time the function runs, and apparently salt1+hash1 matches salt2+hash2 when generated from the same string. I'm really confused with how this works.

import bcrypt # import public crypto hash function bcrypt
import time
from datetime import datetime

password = b"test password" # convert password from string type to bytes type

i = 13 # work factor to determine computation time
start = datetime.fromtimestamp(time.time()) # mark computation start time
salt = bcrypt.gensalt(i)
end = datetime.fromtimestamp(time.time()) # mark computation end time
hashSPW = bcrypt.hashpw(password, salt)
print("Start: ", start)
print("End: ", end)
print("Duration: ", end-start) # print duration
print("Salt: ", salt)
print("HashSPW: ", hashSPW)

user_input = b"test password" # change input here to test
#if bcrypt.checkpw(user_input, hashSPW):
if bcrypt.checkpw(user_input, b"$2y$13$iynZoPYY5DL3TjnAJkOcbevq0QJBfDPMShN27aSG5wzL7MaRza.Sa"): # value got from https://bcrypt-generator.com/
    print("Password Matched!")
    print("Password Does Not Match!")
  • I think I understand how this works. The purpose of all this is to protect the password of the user. In the event someone leaks the server database with salt+hash, the attacker still has to de-crypt the password. He/she has to run the bcrypt function with the salt he leaked from the database along with a dictionary or bruteforce method and compare the results to the hash leaked. Either way, rainbow/lookup tables are eliminated due to the random salt and with work factor involved, it is computationally resource intensive to generate such tables for just 1 password. – Deon Tan Mar 25 at 3:59
  • 1
    please edit your question rather than replying to it as a comment. – Daisetsu Mar 25 at 4:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.