Skip to content

Instantly share code, notes, and snippets.

@timb-machine

timb-machine/Example of bcrypt() weakness around input string truncation (the choice of PHP is arbitrary)

Created March 1, 2025 21:47
Show Gist options
  • Save timb-machine/821489c2e5e0a2b709780e94a54eea09 to your computer and use it in GitHub Desktop.
Save timb-machine/821489c2e5e0a2b709780e94a54eea09 to your computer and use it in GitHub Desktop.
Download ZIP
Example of bcrypt() weakness around input string truncation (the choice of PHP is arbitrary)
Raw
Example of bcrypt() weakness around input string truncation (the choice of PHP is arbitrary)
<?php
if (password_hash("123567890123567890123567890123567890123567890123567890123567890123456789" . "test", PASSWORD_BCRYPT, ["salt" => "1234567890123456789012"]) === password_hash("123567890123567890123567890123567890123567890123567890123567890123456789" . "hell", PASSWORD_BCRYPT, ["salt" => "1234567890123456789012"])) {
print "matches\n";
}
?>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment