I'm researching how to do salt and hashing. I'll be using SHA256. Here is what I found:
To Store a Password
Generate a long random salt using a CSPRNG.
Prepend the salt to the password and hash it with a standard password hashing function like Argon2, bcrypt, scrypt, or PBKDF2.
- Save both the salt and the hash in the user's database record.
To Validate a Password
- Retrieve the user's salt and hash from the database.
- Prepend the salt to the given password and hash it using the same hash function.
- Compare the hash of the given password with the hash from the database. If they match, the password is correct. Otherwise, the password is incorrect.
My question is: How do you get the original salt after it's been hashed to the user's password in the database? You can't "unhash" the salt and add that to the password they've entered and then hash. Wouldn't you get a different result?