# Password hash algorithm

**URL:** <https://meta.discourse.org/t/password-hash-algorithm/128608>\
**Category:** Development\
**Created:** [September 15, 2019, 12:17am UTC](https://meta.discourse.org/t/password-hash-algorithm/128608 "2019-09-15T00:17:22Z")\
**Posts on this page:** 1\
**Showing post:** 9

<div class="post-metadata">

**Author:** ![csmu](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/csmu/32/124581_2.png) [@csmu](https://meta.discourse.org/u/csmu)\
**Post date:** [September 16, 2019, 2:31am UTC](https://meta.discourse.org/t/password-hash-algorithm/128608/9 "2019-09-16T02:31:17Z")

</div>

> [@pfaffman](#):
>
> Rails only makes sense after you know where stuff is. Here’s this

Thanks Jay -

After reading

```plaintext
 def confirm_password?(password)
    return false unless password_hash && salt
    self.password_hash == hash_password(password, salt)
  end

```

in user.rb

the following works for straight ruby validation

```plaintext
user = User.find_by_email('some.email.address')
user.confirm_password?'valid-password'
=> true

```

> [@pfaffman](#):
>
> describing the problem rather than starting with your solution

I was experimenting with a .htaccess file for a server and I was looking for a way to validate a username / password through discourse for that server without knowing the passwords to generate the .htaccess file. The SSO approach is better and knowing how to validate a user name / password without using SSO will be useful for me.

---

_[View the full topic](https://meta.discourse.org/t/password-hash-algorithm/128608)._