0

I have a problem.

I am creating a mysql user, and mysql will store the hashed password in user table. The problem is I dont know how to get the password back. As it is hashed, we can't get it back. If the user forgets their password, then we can't get it back. Then we have to reset the password again. I thought to save the password in some file, but would that be risky?

1
  • 2
    Keeping passwords private, even from admins is important. It means that a user cannot say "I did not log in, it must have been someone with access to my password." If the user forgets their password, they are supposed to reset it.
    – schroeder
    Nov 5, 2014 at 17:15

1 Answer 1

6

The purpose of password hashing is that not even you know the users password. Creating a backup of the cleartext password defeats the whole purpose, because then you have a copy which can get stolen.

Password hashing and telling the user their password are mutually exclusive. When a system uses password hashing, resetting the password to something else is the only possible way to recover a user account when the user forgot their password.

Not the answer you're looking for? Browse other questions tagged or ask your own question.