First, no matter where you store them, you need to make sure you properly hash them. That is priority number one. And note that is hash, not encrypt. Yes, there is a difference. A big difference.
As for where to store them, the obvious traditional choice would be a database. Let's compare storing passwords in a database to storing them in a file. Both choices comes with their own set of easy mistakes that can expose data.
For databases, you need to make sure to protect against SQL injection and harden the database server (don't expose it to the internet, use strong credentials, etc.).
For file based systems, there is a separate group of issues:
- Put the file outside the webroot.
- You need to make absolutely sure there are no local file inclusion vulnerabilities on your server.
- Make sure the file doesn't end up in backups, git repositories, etc.
I'd say it's much easier to get this right with a database, since you have a clearer separation between code and data. But what matters in the end here is the implementation. A poorly written homebrew database library ridden with SQLi is worse than a well established and tested framework for files.
Still, I would expect it to be harder to get this right with files than with a database. And to be honest, getting a login system right in PHP is extremely hard to begin with. Forgive my pessimism, but most people who set out to do this fail and end up with insecure systems. Perhaps you should look into existing frameworks? That would greatly reduce your risk.
(Obviously, databases have some pretty big technical advantages not related to security, but I am leaving that out of the discsussion here.)