title: How to validate user password after hashing using sha-256 salted in Java
body: <p>I am new to Java; so also postgresql I am using for the backend.
  I want to hash user password and save in the database using sha-256
  Next time the user visits, I want to compare the password user submitted with the saved hashpassword, &quot;at the java end&quot;.
  I have tried this (I got from the internet):</p>
  <pre><code>private static String get_SHA_512_SecurePassword(String passwordToHash, byte[] salt) {
          
      String generatedPassword = null;
      try {
          MessageDigest md = MessageDigest.getInstance(&quot;SHA-512&quot;);
          md.update(salt);
          byte[] bytes = md.digest(passwordToHash.getBytes());
          StringBuilder sb = new StringBuilder();
          for(int i=0; i&lt; bytes.length ;i++)
          {
              sb.append(Integer.toString((bytes[i] &amp; 0xff) + 0x100, 16).substring(1));
          }
          generatedPassword = sb.toString();
      } 
      catch (NoSuchAlgorithmException e) 
      {
          e.printStackTrace();
      }
      return generatedPassword;
  }
      
  
  private static byte[] getSalt() throws NoSuchAlgorithmException {
      SecureRandom sr = SecureRandom.getInstance(&quot;SHA1PRNG&quot;);
      byte[] salt = new byte[16];
      sr.nextBytes(salt);
      return salt;
  }
  
  public static void main(String[] args) {
      //do some things ....
      System.out.println(&quot;\nEnter your password&quot;);
      String password = scanner.nextLine();
  
      try {
          byte[] salt = getSalt();
          securePassword = get_SHA_512_SecurePassword(password, salt); // This is saved in the database.
          System.out.println(securePassword);
      
      } catch (NoSuchAlgorithmException e) {
          e.printStackTrace();
      }
  
      //Now ask user to enter his password
      System.out.println(&quot;Enter your password&quot;);
      String password1 = scanner.nextLine();
  
      //validate user password. Compare password with password1
      try {
          byte[] salt = getSalt();
          securePassword1 = get_SHA_512_SecurePassword(password1, salt);
          System.out.println(securePassword1);
      
      } catch (NoSuchAlgorithmException e) {
          e.printStackTrace();
      }
  
      //I believe this is wrong but I don't have alternative
      if (securePassword.equals(securePassword1)) {
          System.out.println(&quot;Both are equal&quot;);
      } else {
          System.out.println(&quot;Both are not equal&quot;);
      }
  }
  </code></pre>
  <p>Even when both passwords are same, the comparison fails.
  The result is same &quot;Both are not equal&quot; whether both passwords are same or different.
  So is there a method of validating the user password? I have searched. The solution I got is to use Spring Bcript which I don't want for now.
  Another alternative I am pushing to future is to do verification at the backend (as is the practise with php-Mysqli password_verify($password, $passwodhashed)). Reason is I am using postgresql with java, both new to me.
  Thank you</p>