# Decrypting salted passwords

**URL:** <https://www.ruby-forum.com/t/decrypting-salted-passwords/67556>\
**Category:** Rails\
**Created:** [September 5, 2006, 7:59am UTC](https://www.ruby-forum.com/t/decrypting-salted-passwords/67556 "2006-09-05T07:59:16Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Patrick\_Elder](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/d9b06d/32.png) [@Patrick\_Elder](https://www.ruby-forum.com/u/Patrick_Elder)\
**Post date:** [September 5, 2006, 7:59am UTC](https://www.ruby-forum.com/t/decrypting-salted-passwords/67556/1 "2006-09-05T07:59:16Z")

</div>

Hello. Does anyone know how to decrypt a salted-hashed password?

The usage:

I am working on an application to store client login information.  
Obviously I need to store the password securly using the salted method,  
but when I go to edit the password or view it; it shows the ecncrypted  
password rather than what it actually is. How can I get the password  
to show?

Thanks in advance for any help!

---

<div class="post-metadata">

**Author:** ![Patrick\_Elder](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/d9b06d/32.png) [@Patrick\_Elder](https://www.ruby-forum.com/u/Patrick_Elder)\
**Post date:** [September 5, 2006, 9:15am UTC](https://www.ruby-forum.com/t/decrypting-salted-passwords/67556/2 "2006-09-05T09:15:27Z")

</div>

From a user perspective, if you need to have users change their  
passwords,  
you can just have them type in their old password and the new one (along  
with a confirmation). They don’t really need to see their password.

For users who forget their password, you can have the system assign a  
new  
one at random, e-mail it to them (before hashing it and storing it to  
the  
database), and ask them to change it once they login.

The point of encryption is that it’s not feasible to decrypt, so you  
have to  
work around your inability to see it.

---

<div class="post-metadata">

**Author:** ![Patrick\_Elder](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/d9b06d/32.png) [@Patrick\_Elder](https://www.ruby-forum.com/u/Patrick_Elder)\
**Post date:** [September 5, 2006, 10:47am UTC](https://www.ruby-forum.com/t/decrypting-salted-passwords/67556/3 "2006-09-05T10:47:44Z")

</div>

On 5 Sep 2006, at 06:47, Patrick Elder wrote:

> to show?  
> Hey Patrick,

The entire point of them is that you _can’t_ decrypt them [1] .  
That’s why it’s secure storage. What was the last application you  
used which let you _view_ a password in cleartext?

Ben

[1] Well, not without a LOT of time and computers.

> Thanks in advance for any help!
> 
> >

–  
Ben B. - Director  
Airsource Ltd  
Tel: 01223 708370 / 07786 916043

---

<div class="post-metadata">

**Author:** ![Patrick\_Elder](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/d9b06d/32.png) [@Patrick\_Elder](https://www.ruby-forum.com/u/Patrick_Elder)\
**Post date:** [September 5, 2006, 11:41am UTC](https://www.ruby-forum.com/t/decrypting-salted-passwords/67556/4 "2006-09-05T11:41:52Z")

</div>

Hi Patrick

if the requirement is to be able to reverse the passwords, you can  
implement  
a reversible encryption instead of using hashing.

have a look over there  
[http://technoweenie.stikipad.com/plugins/show/Acts+as+Authenticated](http://technoweenie.stikipad.com/plugins/show/Acts+as+Authenticated)(currently  
down as it seems). If my memory serves me well, there are bits of  
code illustrating how to achieve this.

keep in mind that if the passwords are reversible, then someone with  
sufficient access rights (eg an admin, or an nasty intruder) is able to,  
well, reverse them.

I use hashing when possible instead.

cheers

## Thibaut

[blog] [NEWS - Online News PortalNEWS](http://www.dotnetguru2.org/tbarrere)

---

<div class="post-metadata">

**Author:** ![Patrick\_Elder](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/d9b06d/32.png) [@Patrick\_Elder](https://www.ruby-forum.com/u/Patrick_Elder)\
**Post date:** [September 6, 2006, 4:19am UTC](https://www.ruby-forum.com/t/decrypting-salted-passwords/67556/5 "2006-09-06T04:19:00Z")

</div>

Thanks for your help everyone. You’ve all helped me understand  
encryption a little better, which sorta clears up my approach with this  
application. It’s not that I am allowing people to change their  
passwords. The application’s objective is to store client information  
(i.e. ftp info, control panel…) and retrieve it as necessary in the  
application. I suppose Acts as Authenticated is the aproach I need to  
take.

---

<div class="post-metadata">

**Author:** ![Patrick\_Elder](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/d9b06d/32.png) [@Patrick\_Elder](https://www.ruby-forum.com/u/Patrick_Elder)\
**Post date:** [September 5, 2006, 8:01am UTC](https://www.ruby-forum.com/t/decrypting-salted-passwords/67556/6 "2006-09-05T08:01:16Z")

</div>

Patrick Elder wrote:

> Thanks in advance for any help!  
> You don’t decrypt it. A hash (in this context, anyway) is 1 way. The  
> point of it is to NOT ever store the original, you only check that the  
> hashed value of what the user typed is the same as the hashed value you  
> stored.