diff --git a/auth.go b/auth.go
index 8f6dea3..91cb744 100644
--- a/auth.go
+++ b/auth.go
@@ -21,7 +21,7 @@ func Login(username, password string) bool {
 			return false
 		}
 		log.Printf("Checking against recovery code %s", rc)
-		if bcrypt.CompareHashAndPassword([]byte(u.Password), []byte(rc)) != nil {
+		if bcrypt.CompareHashAndPassword([]byte(rc), []byte(password)) != nil {
 			log.Printf("scsusers.Login: Failed password for " + username)
 			return false
 		}