If password X is hashed to Y, and you store Y that seems ok.<p>But if you directly check if the client transmits Y then Y is just the new password.<p>At a minimum you should be hashing whatever the client sends and comparing that with the hashed password.<p>PS: Not that most developers should do this by hand.