So I'm developing a website using php, mysql and javascript, and also 'sha512' to encrypt passwords of members using the code :

$password = filter_input(INPUT_POST, 'p', FILTER_SANITIZE_STRING);
$random_salt = hash('sha512', uniqid(mt_rand(1, mt_getrandmax()), true));
$password = hash('sha512', $password . $random_salt);

the p value is ming from :

function formhash(form) {
    var password = randomString();
    var p = document.createElement("input");
    form.appendChild(p);
    p.name = "p";
    p.type = "hidden";
    p.value = hex_sha512(password.value);
    password.value = "";
    form.submit();
}       

function randomString() {
    var text = "";
    var possible = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";

    for( var i=0; i < 9; i++ )
        text += possible.charAt(Math.floor(Math.random() * possible.length));

    return text;
}

My idea here is to reset user password by entering their email and generate random 8 characters then send it directly to their email. The problem I'm facing now is how to get the actual password (not encrypted) that has been generated so it can be automatically sent to the email of the member who requested to reset their password?

So I'm developing a website using php, mysql and javascript, and also 'sha512' to encrypt passwords of members using the code :

$password = filter_input(INPUT_POST, 'p', FILTER_SANITIZE_STRING);
$random_salt = hash('sha512', uniqid(mt_rand(1, mt_getrandmax()), true));
$password = hash('sha512', $password . $random_salt);

the p value is ming from :

function formhash(form) {
    var password = randomString();
    var p = document.createElement("input");
    form.appendChild(p);
    p.name = "p";
    p.type = "hidden";
    p.value = hex_sha512(password.value);
    password.value = "";
    form.submit();
}       

function randomString() {
    var text = "";
    var possible = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";

    for( var i=0; i < 9; i++ )
        text += possible.charAt(Math.floor(Math.random() * possible.length));

    return text;
}

My idea here is to reset user password by entering their email and generate random 8 characters then send it directly to their email. The problem I'm facing now is how to get the actual password (not encrypted) that has been generated so it can be automatically sent to the email of the member who requested to reset their password?

• javascript
• php
• cryptography
• change-password
• sha512

• 3 Don't send passwords via e-mail! Send a link with password reset token which you can pare when the link is clicked and then let the user reset their password. – Artjom B. Commented Dec 5, 2014 at 15:10
• 3 "The problem I'm facing now is how to get the actual password (not encrypted) that has been generated so it can be automatically sent to the email of the member who requested to reset their password?" if they are asking for their password to be reseted, why must you know what is the password? You just reset the password and generate a new temporary one, no? Oh, btw, don't use SHA512 to "encrypt" passwords, they are not password hashing functions. – Braiam Commented Dec 5, 2014 at 15:11

2 Answers 2

Good question.

First, you should never send users their passwords in plaintext. It's considered a bad security practice for a few reasons. If anyone gets access to the email, then they have the password and can hijack the user account. Second, hashing is a one-way form of encryption where you turn the password into gibberish. The big value in hashing is that the same password will always be turned into the same gibberish-- everytime. This means you can do password matching without ever storing the raw password. The reason you're supposed to hash a password and not do 2-way encryption like AES-256, is that 2-way encryption requires the creation, management, and securing of encryption keys which can be hard. Hashing is just easier and more secure for the vast majority of developers.

So how should you implement password reset if you can't send the raw password? You send the user an email with a link to a secure reset page AND a one-time use reset token that expires within a certain window. This way, if someone get's access to the email then the window of risk is limited to the short window.

There are a variety of ways to build this yourself but an easy approach to getting a one-time use token you don't have to store or manage is to offload user management to a microservice like Stormpath where it takes care of all the user management for you-- password reset, password storage, user profiles, authentication, etc.

For password reset here's what it would look like:

User initiates password reset work on a web page

1. You make API call to stormpath with user's email address or username
2. Stormpath sends out reset email to user (your "from" address, custom HTML, etc) with a link + token. The reset token that is unique, one-time use, and expires if not used within 24 hours
3. User clicks on the link and lands on the reset page
4. You pull the token from the URL and check Stormpath for token verification
5. User submits new password
6. Stormpath sends out reset success message (your "from" address, custom HTML, etc)

You can build your own UIs in this flow so the user never knows Stormpath exists.

Now, you don't have to manage, store, or secure any passwords or reset tokens in your database.

Here's are some links to the munity-managed PHP SDK.
http://docs.stormpath./php/quickstart/ http://docs.stormpath./php/product-guide/

Full Disclosure - I work at Stormpath

and also 'sha512' to encrypt passwords

You're not encrypting them, you're hashing them. A hash is a one-way function. You can't take the result of a hash function and get the original. There are many possible original chunks of data that can result in the same hash.

The whole point of hashing in this context is to be able to check passwords without ever actually storing the user's password. You shouldn't send the user their password in e-mail, as e-mail is sent over the internet unencrypted. If you must have the original pre-hashed data for some reason, you must store it before you hash it.