title: How do you test if two hashes (passwords) are similar?
body: <p>When a user creates a password I hash it (including a salt) and save it in the DB.</p>
  
  <p>Now when the user wants to change his or her password I want to test if the new one is too similar to the old one (I have seen this done on different services, especially online banking).</p>
  
  <p>So, I thought I will use the <code>similar_text</code> or <code>levenshtein</code> function. And this works if the user has to type in his or her old password.</p>
  
  <p>But when the user has forgotten their password, and they need to reset it, the obviously don't have to type in their old password. So I would need to compare the new password with the old password (saved in the DB), which I don't have in plain text but a hash.</p>
  
  <p>Now, when I hash the new password using the same salt, and compare it with the old password (hashed), I obviously cannot test whether or not the new and old password are similar.</p>
  
  <p>I am just curious to find out how companies do that, when they don't save the password as a plain text in the DB?</p>
  
  <p>I couldn't really find anything helpful on Google. If anyone has any suggestions, or links to articles that discuss this in more detail, I'd appreciate it if they could share them.</p>