All Questions
2 questions
2
votes
5
answers
2k
views
Using the password hash as a reset token
I had this idea, that instead of generating a password reset token and emailing it to the user, I simply email the user's hashed password to them. Then upon reset, the user would submit the old hashed ...
- 222
47
votes
3
answers
18k
views
Should password reset tokens be hashed when stored in a database?
Passwords are hashed so that if someone gains access to a database of passwords then they won't know what the actual passwords are and so they can't log in.
If I can get a valid password reset token ...
- 1,177