How do I verify a reset token if the token is hashed in DB?
I was pondering this as well and it was hard to find answers.

My solution: don't hash the token with bcrypt. Instead hash it with e.g. SHA256 with no salt. It will be secure enough if the token is truly random data and long enough.

Then the hash will always be the same, so you can easily find it in the database. No need to iterate over all users or tokens in the database &ndash; that would be madness.

Some resources to validate my solution:


How to store the access token / password reset token in the database?
Pre-generating 'secure tokens'
Should password reset tokens be hashed when stored in a database?