Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I understand that sending data from the user to the server, unencrypted, is a bad practice. That is logical.

So how do I encrypt 'userside' and send the data to the server in encrypted form?

Can anyone suggest a good practice example?

What are the advantages and disadvantages of encrypting in Javascript? (What if the user has disabled Javascript?)

share|improve this question
If you are encrypting using Javascript a user could easily reverse engineer your application and discover the key. The best solution is to just use HTTPS – Rell3oT Dec 18 '12 at 20:48
1 discusses in detail why using JavaScript for cryptography is a bad idea. And kudos for recognizing that JS should be a choice that is not forced on the user of the app. – Jonathan Garber Dec 18 '12 at 21:06
Tnx for the answer, u confirmed why not to use JavaScript. So besides using https is there any other option for doing this? – SirSteel Dec 18 '12 at 21:15
Btw, tnx for the matasano article, very good reading – SirSteel Dec 18 '12 at 21:32
up vote 6 down vote accepted

The standard solution is to use SSL (HTTPS).

Please spend some time with the search tool on this site. You will find these questions have all been answered on other questions, so you can find lots of good information. For instance, a search on "Javascript encryption" will find a lot of information about the pitfalls of encrypting on the client-side in Javascript.

Make sure to learn about how to enable SSL sitewide; about HSTS; and about the secure flag on cookies.

In general, I recommend OWASP as an excellent resource with a lot of information about good practices for securing web services.

share|improve this answer
Tnx. I will check that out. – SirSteel Dec 19 '12 at 0:48

other than confidentiality, https solves a lot of other problems. There is no safe way to send passwords in the clear or encoded or obfuscated somehow. Https really is the best solution.

share|improve this answer
Ok, yeah i was just asking for other posibilities, because ssl is an expensive venture. Luckily for me im not building and application which has any really harmful options for users (what i mean its not a banking or buying or anything uf that sorts) I still want to make it as secure as possible given the financial restrictions. So thank your for the answer :D – SirSteel Dec 18 '12 at 22:31
You don't have to purchase a SSL cert - try someone like or search 'free ssl certificates" or just generate a self-signed cert if you are just in the testing phase. – Ryan Griggs Dec 19 '12 at 4:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.