Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I try to encrypt password using MD5 but there are decoders for MD5. So I'm worried about encryption of password for big website.

Is there any logical suggestion or step function to generate strong password?

share|improve this question
    
The simple solution is don't use MD5 use bcrypt. MD5 isn't encryption, you seem confused by this fact, you might want to research the proper way to store a password hash. –  Ramhound Aug 1 '12 at 15:48

3 Answers 3

up vote 2 down vote accepted

I can't understand what you are asking, but has been asked many times here. If you want to know how you should store your passwords; a modern strong keystrengthened cryptographic hash like bcrypt is ideal; at worst use something like sha256/sha512 with a random salt (different for each account) stored with the password. This has been covered in many threads here.

As for how to think of a strong password, random passphrases are great, and diceware is an easy way to come up with one. Also 10+ character long passwords with mix of uppercase/lowercase/numbers/symbols are sufficiently strong. If you use many unique passwords (always a good idea) its helpful to use tools like keepassx to keep an encrypted list of your passwords associated with each site.

Remember never re-use passwords at multiple sites. E.g., if you use the same password at your bank as some random webapp, you have no assurance t hat the random webapp isn't storing your password in plaintext (or near equivalent) and some admin/hacker there will someday try to use that password with other information (like your username) at places like your bank.

share|improve this answer

Md5 is a hashing not an encryption algorithm. Normally its use is deprecated in favour if alternatives such as SHA 128 / 256. Hashed passwords are normally salted too. Try a search for troyhunt who has an excellent series of articles on this very subject.

share|improve this answer
    
"SHA 128" does not exist. And recommending SHA-256 is misleading too, since even with a salt, plain (single iteration) SHA-256 sucks for password hashing. –  CodesInChaos Aug 1 '12 at 11:22

Generate a cryptographically secure random password, hash it and store it alongside a salt. A hash function is designed to be one way, that is, you shouldn't be able to uncover the original plain string from a hash. A salt does not need to be unique or secret and is used to prevent certain types of attacks (such as dictionary attacks).

secret = H ( password || salt )

Where H is a hash function such as, sha512, BCrypt; password is the plain text secret not stored by the system but known by the user; and || is concatenation.

You then store the secret and salt alongside each other.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.