Search code examples
laravel

Editing passwords alongside other form fields in laravel

I have a form that i am using to edit the email and other details of the user table. The other details are columns i have added to the user table.

I want to be able to edit the password and i have several options.

  1. In the edit view, leave the password and confirm password fields blank(no values from the db are displayed in the password field) and allow the user to enter a new password. Only the admin has the ability to edit the users so i have not enter old password feature.

  2. Decrypt the bcrypt encrypted password to plain text and populate the raw text password in the password field and change the form field to text instead of password.

  3. Populate the password field with the bcrypt string stored in the password field of the user password.

Would it be possible to decrypt the user password in laravel?.

Solution

  • Why not just update the password directly?

    $user->password = bcrypt($newPassword);
$user->save();

    There’s never a good reason to decrypt a password or store it in plaintext. In fact, bcrypt is designed to prevent decryption.

    To answer your question directly: Option 1 is the only option.

    Edit: Regarding your second question:

    It's about how to present the password to the user in an edit form alongside other fields. What should go in the password field? Black dots, plaintext, or the bcrypt hash from the user table?

    You can choose what you prefer. You can leave it blank, show stars, dots—whatever works for you. What really matters is how you handle it in the backend.

    I suggest leaving it empty so you can easily check in the backend if a new password was entered:

    if($request->has('new_password')) {
    // update password
}