A password hash stores a derived representation instead of the raw password. In PostgreSQL, pgcrypto combines the password with a randomly generated Blowfish salt; the resulting value includes the salt for later verification. section 7.2.2
Store and verify a password
Create an accounts table with a password_hash column, then insert a password using crypt('SuperSecret123', gen_salt('bf')). To authenticate, compare password_hash with crypt('SuperSecret123', password_hash). The correct password returns ahamilton; an incorrect password returns zero rows. section 7.2.2
Listing 7.3 Encrypting the password for a new user
INSERT INTO accounts (username, password_hash)
VALUES ('ahamilton', crypt('SuperSecret123', gen_salt('bf')));
See the insert statement that generates a random salt and stores the resulting password hash. section 7.2.2
Practical properties:
- Random salts produce different hashes for identical passwords and limit the impact of an exposed salt. section 7.2.2
- Verification reuses the stored hash as crypt’s salt, so the raw password need not be stored. section 7.2.2
