Client

P455w0rd -->

[Sorry, try again]

[Logged in]

Chatter

Plaintext password -->

[Silence]

[Silence]

<-- NO: No cookie for you!

<-- YES: Cookie (success)

Server

* Retrieve salt from database:

Q!%~[m

* Concatenate salt to client password:

P455w0rdQ!%~[m

* Compute hash:

test =
 md5('P455w0rdQ!%~[m')

* Compare computed hash to database:

Do they match?

Database

"user" : {
  "salt" : "Q!%~[m",
  "hash" : "10a53211fdee..."
}

This is why companies can't recover your password.

They don't have it.

Answer to SoloLearn challenge

Secure passwords + Secret challenge answer validator