database 密码恢复：如何解密 md5 加密密码？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/5283490/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Password Recovery: How to decrypt an md5 encrypted password?
提问by Silicone
Possible Duplicate:
Is it possible to decrypt md5 hashes?
可能的重复：
是否可以解密 md5 哈希？
In my website, I'm using md5 encryption for the password. So it's saving in the encrypted form in the database. For doing the password recovery, how can I decrypt the encrypted password ??
在我的网站中，我使用 md5 加密作为密码。所以它以加密形式保存在数据库中。进行密码恢复时，如何解密加密后的密码？？
Please Help :)
请帮忙 ：）
回答by kapa
As others described quite well, you cannot easily 'decrypt' an MD5 hash.
正如其他人所描述的那样，您无法轻松“解密”MD5 哈希。
I guess the best way to do your password recovery is like this:
我想恢复密码的最佳方法是这样的：
A user can request password recovery by providing his email address (it should be unique so users can be identified by email address).
an email is sent to his address with a link containing a unique hash (which you have generated when sending the email and saved it to the db).
when the link is clicked by the user (and of course the unique hash is checked to be equal with the one in the db) you can show a form which lets them choose a different password.
用户可以通过提供他的电子邮件地址来请求恢复密码（它应该是唯一的，以便可以通过电子邮件地址识别用户）。
一封电子邮件被发送到他的地址，其中包含一个包含唯一哈希的链接（您在发送电子邮件时生成并将其保存到数据库中）。
当用户点击链接时（当然，唯一的哈希值被检查为与数据库中的相同），您可以显示一个表单，让他们选择不同的密码。
Another route that some people use is to simply ask for the email address, generate a new password and send it to the user. The problem with this one is that someone who knows only your email address can request a password change. He won't know the new pass, and you will get it by email, but still it is very inconvenient for the user.
有些人使用的另一种方法是简单地询问电子邮件地址，生成一个新密码并将其发送给用户。这个问题是只知道您的电子邮件地址的人可以请求更改密码。他不会知道新的通行证，你会通过电子邮件得到它，但对用户来说仍然很不方便。
回答by Lynn Crumbling
MD5 is a hash-based encryption. What that means, is that there is no way to get back the original value. You have created something that is a "checksum" of the original data. You can use the MD5 algorithm to encrypt something else, and then compare that to the MD5'd version of the data, but you can never get back the original.
MD5 是一种基于散列的加密。这意味着，无法取回原始值。您已经创建了原始数据的“校验和”。您可以使用 MD5 算法加密其他内容，然后将其与数据的 MD5 版本进行比较，但您永远无法取回原始数据。
It would be similar to me saying: 5 + 3 + 2 = 10. The original data is 5, 3, and 2. But the "hash" is 10. There is no way to get the original data from the hash, but if someone supplies the correct input ( 5, 3, 2 ), I can hash it, and confirm that it matches hash that I have on file, 10.
类似于我说的：5 + 3 + 2 = 10。原始数据是 5、3 和 2。但是“哈希”是 10。没有办法从哈希中获取原始数据，但是如果有人提供了正确的输入（ 5, 3, 2 ），我可以对它进行哈希处理，并确认它与我存档的哈希值 10 相匹配。
回答by Justin Largey
I think MD5 is a one way hashing algorithm. What that means is that once you encrypt it, the data cannot be decrypted. (I'm sure a good hacker will disagree though)
我认为 MD5 是一种单向哈希算法。这意味着一旦加密，数据就无法解密。（我相信一个好的黑客会不同意）
Anyways, for passwords you can save the encrypted version of the password in the database. When a user attempts to log in, encrypt the entered password using the same MD5 algorithm, and compare the encrypted version of the password against the encrypted password stored in the database.
无论如何，对于密码，您可以将密码的加密版本保存在数据库中。当用户尝试登录时，使用相同的 MD5 算法对输入的密码进行加密，并将密码的加密版本与存储在数据库中的加密密码进行比较。
Once you're comfortable with this approach, you can start looking at the concept of adding salt to the hashed password.
一旦您对这种方法感到满意，您就可以开始研究向散列密码添加盐的概念。
Also, there are other hashing algorithms than just MD5. If you're using .NET, there's a bunch in the framework, such as SHA512Managed. Each one has its trade offs, such as speed to hash, security, etc. Pick one that fixes your particular problem.
此外，除了 MD5 之外，还有其他散列算法。如果您使用 .NET，那么框架中有很多，例如 SHA512Managed。每个都有其权衡，例如散列速度、安全性等。选择一个可以解决您的特定问题。
回答by Silicone
You can't decrypt a md5 password! The only way would be to brute force it! If you want to do password recovery make a random string witch will be sent to the user by email (or any other way) and set as a md5'd password... Just an idea
您无法解密 md5 密码！唯一的办法就是暴力破解！如果您想恢复密码，请通过电子邮件（或任何其他方式）将随机字符串发送给用户并设置为 md5 的密码......只是一个想法
EDIT:Why would you encrypt a password to keep it safe if you can decrypt it? Makes no sense! -> You could the basically leave the password unencrypted!
编辑：如果可以解密，为什么要加密密码以确保其安全？没有意义！-> 你基本上可以不加密密码！
回答by CodeNaked
It's not easy, but you're best bet would be to use a rainbow tableas the MD5 has does have vulnerabilities.
There are several online versions, which you may or may not be able to trust (or work).
有几个在线版本，您可能会也可能无法信任（或工作）。
回答by MRVB70
You can try to search in a MD5 hash database like:
您可以尝试在 MD5 哈希数据库中进行搜索，例如：
Chances are small but you can try.
机会很小，但你可以试试。
