How do I verify a reset token if the token is hashed in DB? I've been searching around the web for best practice how-to on secure password reset system (email with reset url), and the idea to hash the token in the database, which I did not implement at first, seems to be the the most secure way to store the token.

Im currently following this guide, and he does not mention it (why?)

Im using bcrypts for password hashing allready, so thats what im using for this aswell. 

How ever, the syntac for the verify is like this: Bcrypt.verify(non-hash, hash);

So my question is this:  If the reset-link only contains the token (which is not in db, the hash is) - how can I find the user in the db?

is it safe to append email/userID to the reset-link as well? None of the other services Ive seen have does this (afaik), only the token (do they not hash the token in the db?).

I dont want to make my own scheme that will create a security issue, so how do I proceed with this ?

Using asp.net web forms and c#
I was pondering this as well and it was hard to find answers.

My solution: don't hash the token with bcrypt. Instead hash it with e.g. SHA256 with no salt. It will be secure enough if the token is truly random data and long enough.

Then the hash will always be the same, so you can easily find it in the database. No need to iterate over all users or tokens in the database &ndash; that would be madness.

Some resources to validate my solution:


How to store the access token / password reset token in the database?
Pre-generating 'secure tokens'
Should password reset tokens be hashed when stored in a database?