Hashing a password with the password?

Question

I was wondering if hashing a password with the password would be a good way of encrypting the password. So, the user must know his/her password to get the same result as the one in the database. Also, this would prevent decrypting of the password without the password... right?

I've read articles and other SO questions/answers on hashing passwords, but was wondering if this would actually work.

Answer 1

Short answer: Use bcrypt.

Long answer:

First, "hashing a password with the password" is an undefined statement. Regardless, you are well into "inventing your own crypto" territory. Assuming you mean something along the lines of SHA-256(password + password), this is a phenomenally bad password digesting scheme. Being unsalted, your approach is vulnerable to rainbow attacks. Not using key stretching, your approach is vulnerable to brute forcing with GPGPUs.

BCrypt is vulnerable to none of these. It uses cryptographically random salts, ensuring that duplicate passwords do not hash to the same value. And it requires a significant amount of work to be performed by an attacker in order to generate each hash, requiring tens to hundreds of thousands of times more computation per password attempt.

Edit: In the comments, it was clarified that the meaning was something along the lines of SHA-256(password + SHA-256(password)). This is susceptible to precisely the same attacks: identical passwords hash to identical values, which is a serious flaw. And again, hashing is fast. Fast enough to brute force a huge number of your passwords, if given your password database. Real key derivation functions significantly increase the cost of brute forcing past the point where it's no longer a practical attack vector.