title: Hash function not returning the same output for identical input
body: <p>I am currently working on implementing a website that allows a user to (fictionally) buy and sell stocks. This is problem set 9 in Harvards' CS50 computer science course. My program compiles, functions and passes all checks. However, the past few days I've been stuck trying to implement a password change option. </p>
  
  <p>On the password change page, I prompt the user to input their old password. Then, the user has to input their desired new password. Finally, the user has to confirm their new password once more.</p>
  
  <p>However, my hashing function seems to output a different hash when a user inputs their old password, than it did when they registered with this password. This causes my comparison check between the hashed password in the database and the user input to always return false.</p>
  
  <p>Below is the python code for the implementation of the password change. Below it is the html code for the actual page on which the user can change their password.</p>
  
  <pre><code>@app.route("/change", methods=["GET", "POST"])
  @login_required
  # PERSONAL TOUCH: &lt;Allows user to change their password&gt;
  def change():
  """Allows user to change their password"""
  
  if request.method == "GET":
      return render_template("change.html")
  
  else:
  
      # Returns an error if Password is left blank
      if not request.form.get("originalpassword"):
          return apology("User must submit their original Password.", 400)
  
      elif not request.form.get("newpassword"):
          return apology("User must submit a new Password.", 400)
  
      elif not request.form.get("newconfirmation"):
          return apology("User must confirm their new Password", 400)
  
      # Hashes the Password
      Password = request.form.get("originalpassword")
      print("GIVEN PASSWORD: ", Password)
      HashedPassword = generate_password_hash(Password, method='pbkdf2:sha256', salt_length=8)
  
      # Returns an error if the user typed in a non-valid original password
      OldHashedPassword = db.execute("SELECT hash FROM users WHERE id = :id", id=session["user_id"])
      Old_HPW = OldHashedPassword[0]["hash"]
  
      print("given hash: ", HashedPassword)
      print("actual hash: ", Old_HPW)
  
      print("=====\n",OldHashedPassword,"\n=====\n")
  
      if not Old_HPW == HashedPassword:
          return apology("Submitted password is not valid.")
  
      # Returns an error if Password and Confirmation are not identical
      if not request.form.get("newpassword") == request.form.get("confirmpassword"):
          return apology("New Password and Confirmation must be identical.", 400)
  
      # Hashes the new Password
      NewPassword = request.form.get("newpassword")
      NewHashedPassword = generate_password_hash(NewPassword, method='pbkdf2:sha256', salt_length=8)
  
      # Insert the new Password into the database
      insertPW = db.execute("INSERT INTO users (hash) VALUES(:hash)", hash=NewHashedPassword)
  
      return redirect("/")
  </code></pre>
  
  <p>And the HTML code: </p>
  
  <p><a href="https://i.stack.imgur.com/geGlI.png" rel="nofollow noreferrer">HTML Code</a></p>
  
  <p>I did include a few print statements in order to debug. I registered a new account with username 'q', and password 'q'. Then, I attempted to change the password into 'qq'. During registration, the input 'q' resulted in the following hash: </p>
  
  <p>pbkdf2:sha256:50000$sBxqbmza$e35dd4e61eb186af014e5e1ce3b73450b1361baabdd2f5f4559ad83ef0d5b45b</p>
  
  <p>However, when I input 'q' into the 'original password' form field, the generate_password__hash function returns the hash:</p>
  
  <p>pbkdf2:sha256:50000$iAjKAPM1$f7644f34f21864062efa2f3e3f3ea0a89a8a3391a0223c1a62fa7cbaab012a71</p>
  
  <p>The values printed by the print statements are: </p>
  
  <p>GIVEN PASSWORD:  q</p>
  
  <p>given hash:  </p>
  
  <p>pbkdf2:sha256:50000$iAjKAPM1$f7644f34f21864062efa2f3e3f3ea0a89a8a3391a0223c1a62fa7cbaab012a71</p>
  
  <p>actual hash:  </p>
  
  <p>pbkdf2:sha256:50000$sBxqbmza$e35dd4e61eb186af014e5e1ce3b73450b1361baabdd2f5f4559ad83ef0d5b45b</p>
  
  <p>Apologies for the very long post. Does anyone have an idea what is causing the hash function to output a different hash value for a (seemingly) similar input?</p>
  
  <p>Thanks!</p>
  
  <p>EDIT: this new code seems to have solved the problem:</p>
  
  <p><a href="https://i.stack.imgur.com/geGlI.png" rel="nofollow noreferrer">NEW CODE</a></p>