I use the ENCRYPT function to generate password for my email users.

SELECT ENCRYPT('password', CONCAT('$6$', SUBSTRING(SHA(RAND()), -16)))

This function will generate a long encrypted string which looks something like this:


Now my question is how I can verify the password? What I want to do is I store the encrypted password in the database. And I want my user to be able to modify their password as long as they provide the correct old password. So when the users provide their old passwords, I need to verify whether the old password they provided is correct or not.


1 Answer 1


When you store a password you have to store encrypt(password,salt) and salt for this user. To check if input from user is the right password you comapre encrypt(input,salt) with the stored encrypted string. Chanck the section about 8.6.2 What Is Salt? in Practical UNIX & Internet Security, by Simson Garfinkel & Gene Spafford from O'Reilly.

  • Aha!! select ENCRYPT('password', CONCAT('$6$', 'abcdefg')), I got $6$abcdefg$3X6B9zrxtsDSfe156ekDjYJE5pBAceZ/kH.QSD8ox8dEyWApg7m77P.AVlozLKGG9WTEbwcb/gjbMape6/Ios1. I think it's solved. The salt is indeed stored in the encrypted password.
    – Qian Chen
    Aug 3, 2015 at 20:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.