title: how to compare a password text with the bcrypt hashes?
body: <p>I have a use case in my application that should prevent the user from choosing one of their last 3 passwords while resetting their password. I'm using Angular for the front end and Spring Boot for the back end . In my scenario, the user passwords are stored as bcrypt hash. </p>
  
  <p>How can I compare the password entered by the user with the last 3 stored bcrypt passwords? </p>
  
  <p>When I run the following code snipped example,</p>
  
  <pre><code>BCryptPasswordEncoder b = new BCryptPasswordEncoder();
  
      for(int i =0;i&lt;10;i++) {
          System.out.println(b.encode("passw0rd"));
  
      }
  </code></pre>
  
  <p>it generates the following bcrypt hashes. each hash is different which is reasonable because when I check the <code>org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder</code>, I can see the salt generated is random value. </p>
  
  <pre><code>$2a$10$tztZsPFZ.T.82Gl/VIuMt.RDjayTwuMLAkRkO9SB.rd92vHWKZmRm
  $2a$10$yTHyWDmcCBq3OSPOxjj4TuW9qXYE31CU.fFlWxppii9AizL0lKMzO
  $2a$10$Z6aVwg.FNq/2I4zmDjDOceT9ha0Ur/UKsCfdADLvNHiZpR7Sz53fC
  $2a$10$yKDVeOUvfTQuTnCHGJp.LeURFcXK6JcHB6lrSgoX1pRjxXDoc8up.
  $2a$10$ZuAL06GS7shHz.U/ywb2iuhv2Spubl7Xo4NZ7QOYw3cHWK7/7ZKcC
  $2a$10$4T37YehBTmPWuN9j.ga2XeF9GHy6EWDhQS5Uc9bHvJTK8.xIm1coS
  $2a$10$o/zxjGkArT7YdDkrk5Qer.oJbZAYpJW39iWAWFqbOhpTf3FmyfWRC
  $2a$10$eo7yuuE2f7XqJL8Wjyz.F.xj78ltWuMS1P0O/I6X7iNPwdsWMVzu6
  $2a$10$3ErH2GtZpYJGg1BhfgcO/uOt/L2wYg4RoO8.fNRam458WWdymdQLW
  $2a$10$IksOJvL/a0ebl4R2/nbMQ.XmjNARIzNo8.aLXiTFs1Pxd06SsnOWa
  </code></pre>
  
  <p><strong>Spring security  configuration.</strong>   </p>
  
  <pre><code>  @Configuration
      @Import(SecurityProblemSupport.class)
      @EnableWebSecurity
      @EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
      public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
  
          @PostConstruct
          public void init() {
              try {
                  authenticationManagerBuilder
                      .userDetailsService(userDetailsService)
                      .passwordEncoder(passwordEncoder());
              } catch (Exception e) {
                  throw new BeanInitializationException("Security configuration failed", e);
              }
          }
         @Bean
          public PasswordEncoder passwordEncoder() {
              return new BCryptPasswordEncoder();
          }
      }
  </code></pre>