title: Rails > Devise password encryption
body: <p>I'm trying to implement a method to allow password to be changed from another service outside devise anyhow.</p>
  
  <pre><code># Profile password change
  def change_password(oldpass, newpass)
      pepper  = nil
      cost    = 10
  
      # Encrypt plain text passwords
      encrypt_old     = ::BCrypt::Password.create("#{oldpass}#{pepper}", :cost =&gt; cost).to_s
  
      # Validate old
      if self.encrypted_password == encrypt_old
          encrypt_new     = ::BCrypt::Password.create("#{newpass}#{pepper}", :cost =&gt; cost).to_s
          self.encrypted_password = encrypt_new
          self.save
      else
          Logger.new("Wrong old password!")
      end
  end
  </code></pre>
  
  <p>It seems i got the password encryption wrong oldpass contains a plain text of old password i need to hash it see if it matches the current password then allow new password to be stored. However all that i'm getting is wrong password.</p>
  
  <p>Reworked:</p>
  
  <pre><code>def change_password(oldpass, newpass)
      if valid_password?(oldpass)
          password = newpass
          save
          return true
      else
          return false
      end
  end
  </code></pre>