Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know it's generally said that storing user credentials in plaintext is a horrible idea. I'm in the middle of implementing Basic Auth over SSL and was wondering what I should do with the user credentials once they're decrypted. Once I decrypt from the wire, I need to make sure the credentials match what's stored in the db. What's a secure way to get this done?

share|improve this question
It's actually covered by the answer below, but I'll reiterate: you should never store a password in a way that enables anyone (including yourself) to figure out the original (plaintext) password. – Joel L Apr 12 '13 at 16:44

You need to store a hashed version of the password in your database. Upon receiving the password from the wire, you recompute the hash and check that it matches the stored version.

This shall be done this care. This answer explains it all.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.