How to show hashed password - php

Question

I have successfully hashed the password users register on my website and by using password verify function, I can check their original password against the hashed one and allow them to login. but on their my account page, i want them to see their original password but it shows the hashed password in their my account page. is there a function that would convert the hashed password to its original on the my account page?

Answer 1

I have successfully hashed the password users register on my website and by using password verify function
Good, Then you ask
I want them to see their original password but it shows the hashed password in their my account page. is there a function that would convert the hashed password to its original on the my account page?
No you can't do that or it kills the whole purpose of hashing.
so in another words, users cannot update their password right? because I have a update info page too
To be able to update their password they don't need to see it, they just need to know it.

Answer 2

Hashed passwords cannot be retrieved in general (this depends on the hashing function, secure hashes cannot be retrieved). If they have the same hash on two sites, they could have the same password, this depends on the hash salt used by the sites, what method etc.

Answer 3

There is no way to get the hashed password. If you wish the user to update the password with confirming the old password, get the old password as an input entry along with the new password and compare the hash value of that with the value stored in the database. If the hash value of the old password is same as that in the database, then allow the user to update the password. Else alert that the old password is wrong

Answer 4

md5 and sha1 are one way, probably one of them you are using (just a guess). If you need two way, you can simply use mcrypt_encrypt and mcrypt_decrypt.
But, I would not suggest you to show passwords to user:-
For Change Password: you can simply ask user for their old password and new password, encrypt it and do match with encrypted password in stored database, if they do match, update new encrypted password in the database for the respective user.
For Forgot Password: You can generate a token, for that particular user and send it with the link (Reset Password) as parameter to their desired email address, and when they use that link, you will get the token to verify and store new encrypted password in your database.

Answer 5

If you want to see passwords with admin panel, you don't need to hashed password. Simply you encypt the password using openssl_encypt() function and then for see the password you can use openssl_decypt() function..
//You can use the following code...
<?php
// Store a string into the variable which
// need to be Encrypted
$simple_string = "Welcome to Sidedevelopers";
// Display the original string
echo "Original String: " . $simple_string . "\n";
// Store cipher method
$ciphering = "BF-CBC";
// Use OpenSSl encryption method
$iv_length = openssl_cipher_iv_length($ciphering);
$options = 0;
// Use random_bytes() function which gives
// randomly 16 digit values
$encryption_iv = random_bytes($iv_length);
// Alternatively, we can use any 16 digit
// characters or numeric for iv
$encryption_key = openssl_digest(php_uname(), 'MD5', TRUE);
// Encryption of string process starts
$encryption = openssl_encrypt($simple_string, $ciphering,
$encryption_key, $options, $encryption_iv);
// Display the encrypted string
echo "Encrypted String: " . $encryption . "\n";
// Decryption of string process starts
// Used random_bytes() which gives randomly
// 16 digit values
$decryption_iv = random_bytes($iv_length);
// Store the decryption key
$decryption_key = openssl_digest(php_uname(), 'MD5', TRUE);
// Descrypt the string
$decryption = openssl_decrypt ($encryption, $ciphering,
$decryption_key, $options, $encryption_iv);
// Display the decrypted string
echo "Decrypted String: " . $decryption;
?>
Output:
Original String: Welcome to Sidedevelopers
Encrypted String: hwB1K5NkfcIzkLTWQeQfHLNg5FlyX3PNUA==
Decrypted String: Welcome to Sidedevelopers