I'm kind of curious: Why would we store a password in a database when we can just encrypt a phrase such as "unlock me" using that password and then, at login, seeing if the encrypted phrase can be successfully decrypted with that key? The way I see it, there is one advantage: If someone should hack into a computer network and gain access to your account, if the encrypter uses an algorithm impervious to known-plaintext attacks, they could change the password but would "never" be able to obtain the original password, thus enabling you to use that password on more secure sites.

Come to think of it, we can - and probably do - use a similar technique in password managers.

  • You might be interested in the Microsoft Passport feature that's in Windows 10 Sep 26, 2015 at 3:04
  • blogs.technet.com/b/ad/archive/2015/07/21/…. Well, it will be in Windows 10 after an update set for later this fall, anyway. But, of course MS is hardly the first to pursue the idea of using two-key cryptography to replace password based-auth for consumers, though if Passport succeeds (a big if) it would be the most prominent so far. And, of course, two-key crypto is at the heart of tons of certificate & signing-based auth mechanisms not specifically intended to replace passwords. Sep 26, 2015 at 3:17
  • You shouldn't ever store passwords in a database - see security.stackexchange.com/questions/211/… Sep 26, 2015 at 3:36

1 Answer 1


If you encrypt the same phrase for all users, this will cause two main issues:

  • Two users sharing the same password will be immediately identifiable since they will share the same encrypted version of it,
  • Bruteforce attack against this base will be easy, since it will be sufficient to calculate only one password hash to compare them to all user in order to determine if one user uses this password.

Of course, you could then try to use a different string for each users, like this person who thought about the same scheme as you but used the username instead of a fixed hardcoded sentence.

But even there, you will end-up with the major issue that encryption function are designed to be fast and require as few resources as possible. This is also a great present for brute-force attacks since this means that a huge number of passwords will be tried in a very short amount of time.

So, the conclusion of all this is that, when trying to protect authentication passwords, you should definitively rely on functions specially crafted for this usage.


Not the answer you're looking for? Browse other questions tagged .