Hello.
I was wondering why even for the same username and the same password, httpasswd outputs a new hash everytime? I tried finding an answer to this question, but couldn't.
+2
A:
The passwords generated by "htpasswd" use a random salt, to make it harder to guess. It also means that pre-crypted dictionaries for attacks have to be much larger since they have to crypt every possible password with every possible salt.
htpasswd uses crypt(3) behind the scenes.
Paul Tomblin
2010-05-18 11:49:25
Thanks. I was not aware of the random salt.
sukhbir
2010-05-18 12:29:27
`passwd`, the Unix password changing utility does the same thing. (Although these days, many of them do MD5 passwords instead of crypt, so there isn't a salt.)
Paul Tomblin
2010-05-18 13:16:48