I'm migrating passwords from one system (bcrypt) to another (also bcrypt) differing only in their salting. I noticed that encrypting the same plaintext password on one system generates a different string than encrypting the same plaintext password on the other. However, hashing and copying the resulting encrypted pw from system A into system B still results in successful authentication on system B.

It would appear I can simply migrate the hashed passwords from one system to the other, but I wonder if this is a potential security concern because the salting is different.

  • $\begingroup$ The passwords are not encrypted. They are hashed. $\endgroup$ – Future Security Nov 4 '19 at 19:10

What do you mean by "differing only in their salting"? A correct implementation of bcrypt should generate a unique salt for each hashed password. The salt is stored along with the hash itself, so yes, the migration is as simple as just using the old values in the new system.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.