I am trying to migrate data from a custom database which uses a different method to HASH the password.

password = md5(email + password + salt)

During the process of migration I face two issues.

I ) To differentiate the new register Drupal passwords from Old site passwords. I tried adding "OLD$" code to the old password using

  public function prepareRow(Row $row) {

    if ($value = $row->getSourceProperty('password')) {
      $row->setSourceProperty('password', 'OLD$' . $value);

    return parent::prepareRow($row);

But this doesn't seem to work.

II ) To check the passwords with old hash, I read in a blog post that new service needs to be created by extending PhpassHashedPassword

public function check ($password, $hash) {

    if (substr($hash, 0, 2) == 'U$') {

      $stored_hash = substr($hash, 1);
      // Here you use the same algorithm the old site has to hash passwords
      // and store it on $password.

      if (substr($stored_hash, 0, 3) == '$P$') {
        // A phpass password generated using md5. This is a password migrated with
        // md5_passwords = TRUE
        $computed_hash = $this->crypt('md5', $password, $stored_hash);
        return $computed_hash && Crypt::hashEquals($stored_hash, $computed_hash);

In my algorithm, password = md5(email + password + salt) the salt and email ID are needed. How can I get the values in check function

  • 1
    You can't, it's not available to that function. The only way to make this work is to customize the login form completely so that you don't use the default authenticate service but your own API
    – Berdir
    Jan 19 '18 at 21:45
  • Thanks for clarifying and saving me from wasting more time on this. Just need one clarification, Is there a way to migrate the MD5 passwords as it is without Drupal rehashing it? Jan 20 '18 at 6:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.