Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am currently studying AES algorithm and writing a Code using Python. I am trying to add 'Salt' into the user input password,

Here is what I am doing,

import hashlib
import os
password = "Sufiyan Ghori" 
salt = os.urandom(32) # 32bytes * 8 = 256bits
# Adding the Password into the first 128bits of SALT
# So that the password could be encrypted
Encoded_Password = password.encode('utf-8') + salt[:16]
# Output will be, Password + Salt

I've added comments above for better understanding.

If the 32-byte salt is equal to


then Password + Salt[:16] would be

b'Sufiyan Ghori\x937{\xa0\x9bo\x9f\x8b1\xbf\xa9\xc9\x01\x86\xa1\xd9'

If I then create its digest using sha512,

sha512 = hashlib.sha512( Encoded_Password ).digest()

the output will be


How am I supposed to recover the original password — which is Sufiyan Ghori — from this fixed-length hash value now?

share|improve this question
a simple password hash is not a key derivation function... – Richie Frame Oct 9 '13 at 18:49
up vote 4 down vote accepted

You cannot recover the password from the hash. That's not something that password hashes are designed for — quite the opposite: with a proper password hash, the only way to recover the password given the hash is to make a guess and verify it — and the better the hashing scheme, the more costly verifying guesses is.

Passwords are used for authentication: a client attempts to prove its authenticity to a verifier by proving that it knows the password. The client knows the password and does not need to recalculate it. The verifier knows the password's hash; the client tells the verifier what it claims the password is, and the verifier computes the hash of the candidate password and compares it with the reference hash. The verifier does not need to compute the password. This works because computing the hash of the password is deterministic (the calculation always gives the same result).

A password hash needs three ingredients:

  • Hash: a one-way function (or a good enough approximation — a function for which nobody knows how to compute inverses), so that the password cannot be recovered from the hash except with a lucky guess.
  • Salt: a unique value that makes the hash computation unique, so that adversaries wishing to break passwords cannot make computations that are useful to break many passwords at once.
  • Slowness: so that brute force attempts by an adversary who knows the hash (make a guess, compute its hash, compare it against the known hash) take an impractically long time even for practical, low-entropy passwords.

See How to securely hash passwords? for a more detailed explanation.

Your password hashing scheme has two of the three ingredients: hash and salt. Keep in mind that the salt must be saved with the hash value so that the same hash computation can be made when a client submits a candidate password. You're missing slowness, which can be achieved by making many iterations of the hash function. There are better ways of achieving slowness which also make it harder to design specialized hardware dedicated to fast password computations; again, see How to securely hash passwords? for more details.

share|improve this answer
"That's not something that password hashes are designed for." You might want to word this a bit stronger: "Password hashes are specifically designed to prevent this from happening." – orlp Oct 9 '13 at 15:16
@nightcracker Done, is that ok now? – Gilles Oct 9 '13 at 15:34
I think "You cannot recover the password from the hash." is misleading. I think the fact that if you use a bad hashing method you can recover the password means this opening line should be reworded. To what, I'm not entirely sure. That and I think every other word should link to "How to securely hash passwords", just to make sure to get across the point that this is a solved problem in our field. (The bigger problem is getting developers to do it!) – corsiKa Oct 10 '13 at 4:25
@corsiKa The hash in question is a salted SHA-512, so for this hash, it is true (except of course by guessing and verifying, which the next sentence discusses). – Gilles Oct 10 '13 at 7:38
@corsiKa If you use a broken hashing method then anything can happen. But a hashing method must be terribly broken if you can retrieve the original password without reverting to brute force. I don't think we have to mention that the implementation should not be using broken functions for every answer. – Maarten Bodewes Oct 12 '13 at 11:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.