PHP BCrypt output correct?

Question

New to stackoverflow :)

I just now started to use a bcrypt function I've found on some site about security. I've never really worried about the output from this until our technician at work said this to me:

The salt seems to always be in the front of every password.

Is this correct or have I made a major boo boo? :)

The code I use is this:

<?php
function bcrypt($password, $salt, $rounds=12) {
    // Check if bcrypt is available on the server
    if (CRYPT_BLOWFISH != 1) {
        throw new Exception("bcrypt stöds inte. Se http://php.net/crypt");
        return;
    }

    // Check that rounds are within the allowed range
    if ($rounds < 4)
        $rounds = 4;
    else if ($rounds > 12) 
        $rounds = 12;

    // Create a prefix to tell the crypt that we want to use bcrypt
    $salt_prefix = sprintf('$2a$%02d$', $rounds);

    // Check if the salt contains invalid characters:
    if (!preg_match('#^[A-Za-z0-9./]{22}$#', $salt)) {

        // The salt is not bcrypt-safe. Redo to 22 characters (A-Za-z0-9. /)
        $new_salt = base64_encode($salt);

        if (strlen($new_salt) < 22)

            $new_salt .= base64_encode(md5($salt));
            $salt = substr($new_salt, 0, 22);
            $salt = str_replace(array('+', '-'), '.', $salt);    
            $salt = str_replace(array('=', '_'), '/', $salt);
    }

    // hash the password with bcrypt
    return crypt($password, $salt_prefix.$salt);
 }

 // Examples :
 echo "Bcrypt: ". bcrypt('abc', 'QyrjMQfjgGIb4ymtdKQXIr', 12);
?>

This will output:

Bcrypt: $2a$12$QyrjMQfjgGIb4ymtdKQXIewDBqhA3eNppF8qOrMhidnEbzNvmHqhy

As you can see the salt is inside the password now "bold text":

Salt = QyrjMQfjgGIb4ymtdKQXIr

pass = $2a$12$QyrjMQfjgGIb4ymtdKQXI

ewDBqhA3eNppF8qOrMhidnEbzNvmHqhy

This seem to be the same every time regardless of salt. Salt is always included except the last character?

Answer 1

You can test an existing bcrypt hash with lots of tools online, like this bcrypt generator