I have the hashed password and its salt. It is encrypted using SCRYPT by firebase.

How can I extract the plain text password from these two?
Or alternatively, how can I re-encrypt or convert them to hash/salt that is readable by passport-local-mongoose plugin? here is an example of what I have at my disposal:

  "hash": "jHyvk2qCPRncEAq5H05JeO4873MIMeyakVMmUXDjRfcdvflDvOXoEn7AhTW0T4f2zb24JYyPrIwTW96C4/iZ+A==",
  "salt": "zVzcUzIS+wCC+w=="

The whole point of a PBKDF like scrypt is that you can't. So that if somebody hacks the server and retrieves the hash and the salt they cannot reconstruct your password which you might have used on other sites.

  • $\begingroup$ nor be used by another auth plugin like the passport.js local mongoose plugin? Since I am changing my auth module, and not using firebase anymore, so I would like to keep the same accounts and passwords, so that the users can use their old password to sign in. How can this be possible? $\endgroup$
    – cplus
    May 8 '17 at 15:36
  • 1
    $\begingroup$ It's certainly possible for your new system to authenticate against those credentials as long as the relevant scrypt parameters are the same between the new systems. Whether this is possible for a particular piece of software is a question for another site. $\endgroup$
    – bmm6o
    May 9 '17 at 0:12
  • $\begingroup$ You can try to bruteforce it, but generally you have two options: have the new authentication system understand the old format or implement a function to log the new format for every accepted login on the old system (at login time your user tells you the password) $\endgroup$
    – eckes
    May 11 '17 at 2:35

Not the answer you're looking for? Browse other questions tagged or ask your own question.