I want to implement functionality which restrict the customer to not enter his old password. Means customer can not enter the same password which is previously entered by customer.I am stuck in comparing the old password with the new password if they are same.

Any help will be appreciable.

1 Answer 1


I got the solution. Magento stores the password in md5 hash format. But it concatenate the salt value with the password then convert it into md5 hash format preceded with the : and salt value.


Here is the solution

        $customer =Mage::getModel('customer/customer')

        $hash = $customer->getData('password_hash');
        $hashPassword = explode(':', $hash);
        $firstPart = $hashPassword[0];
        $salt = $hashPassword[1];

            // do your stuff
  • Good answer. Was your intention to prevent the immediate past password from being used again or a number of previous passwords? PCI rules might require the latter
    – scrowler
    May 28, 2016 at 0:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.