对密码进行反哈希处理
出于安全原因，必须将散列密码存储在数据库中。
如果用户忘记了自己的账户密码，如何找回？我现阶段只能分享他们的哈希密码，这对他们来说毫无用处。
如果密码经过 md5、sha1 和附加盐哈希处理，您能恢复密码吗？
One must store the hashed password in the database for security reasons.
If a user does not remember their account password, how can they retrieve it back? I can only share their hashed password at this stage, which is useless to them.
Can you recover the password if it is hashed by md5, sha1 with additional salt?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
请务必小心那些可以通过电子邮件向您发送您使用的密码的网站。这意味着有权访问密码数据库的任何人都可以轻松看到您的密码，如果您重复使用密码，这尤其危险。
对于密码重置，我建议使用“安全问题”以及加密的答案。
所有网站运营商都有责任确保其客户免受黑客攻击。
Always beware sites that can e-mail you the password you use. That means your password is easily seen by anyone who has access to the password database, which is especially dangerous if you reuse passwords.
For password resetting, I recommend using 'safe questions' with answers that are also encrypted.
It behooves all those who operate websites to keep their customers reasonably safe from hackers.
是的..人们可能会忘记他/她的密码..使用散列密码时的良好做法是让用户输入他/她想要重置密码的帐户的电子邮件地址，然后系统将使用另一个密码重置用户密码生成的密码。 MD5之类的散列密码几乎不可能从散列密码中检索到原始密码
yes..one may forgot his/her password..the good practice while using hashed password would be to make the user type the email address of the account whose password he/she want to reset then the system will reset the users password with another generated password. The MD5 like hashed password is almost impossible to retrieve the original password from the hashed one
散列本身代表“无法检索回来”。
如果用户忘记了他们的密码，他们肯定不需要这个密码。
只需创建另一个随机的并发送它们即可。
没什么大不了的。
hashing itself stands for "cannot be retrieved back".
If a user cannot remember their password, they don't need this one for sure.
Just create another random one and send them.
Not a big deal.
散列而不是加密密码的安全性在于您无法反转散列。如果您可以对密码进行解散列并为用户提供纯文本密码，那么任何黑客都可以反转您用于注册和登录的散列密码并对其进行“解散”以获取用户的密码。
这是一个功能，而不是一个错误。
The security of hashing instead of encrypting the password is that you cannot reverse a hash. If you could unhash the password and give the user their plain text password, then any hacker can reverse the hashed password you use for registration and sign in and "dehash" it to get the user's password.
This is a feature, not a bug.
这注定是棘手的。因此，您通常必须提供某种重置方法。发送特殊链接到用户的电子邮件很常见，尽管这会降低电子邮件帐户的安全性。
请参阅
忘记密码：实现忘记密码功能的最佳方法是什么？
。
This is meant to be intractable. Thus, you usually have to provide some way of resetting it. Sending a special link to the user's email is common, though it reduces your security to that of the email account.
See
Forgot Password: what is the best method of implementing a forgot password function?
.
只有一个简单的答案：不能。
嗯，理论上可以，但如果密码足够长，每个密码可能需要很多年。毕竟，这就是对密码进行哈希处理的首要目的：使数据对攻击者来说实际上毫无用处（或者至少保护用户的明文密码，这是敏感数据。）
只需让网站发送“更改密码” " 电子邮件包含指向用户可以更改其密码的页面的链接。这就是大多数专业网站处理这种困境的方式。
There is but one simple answer: You cannot.
Well, theoretically you could, but it could take many years per password if they are long enough. After all, that is the point of hashing passwords in the first place: to make the data effectively useless to an attacker (or at least protect the user's plaintext password, which is sensitive data.)
Just have the site send a "change your password" email containing a link to a page where that user can change his/her password. This is how most professional sites handle this dilemma.