I am writing a server using nodejs. It is on a public GitHub repository, so its complete code is visible to anyone. The client can send strings to the server. I need to determine if the given string is the admin password. How can I check if the string matches the admin password, without revealing the password in the source?

Note: I must use open-source, so it can't just be a private repository.


Do not hardcode a password into the code. Instead make program read the password from either a database or a file which is stored with the program. This file should not be uploaded to the source code of the program.

Hardcoding the password is very bad idea.

Mirai then identifies vulnerable IoT devices using a table of more than 60 common factory default usernames and passwords, and logs into them to infect them with the Mirai malware.

| improve this answer | |
  • In the case of Mirai, the problem was that the default passwords were known. Here, I would be the only person to know the password. It wouldn't be part a publicly known table of passwords. I would like to avoid using an additional database file. – Baked Potato Jun 8 '18 at 22:26
  • well hard coding the password to the source code would make it known to other people, which is very similar principle. There is a lot of examples of similar things happening. It anyway is better to store the password outside the source code. This would allow for easier change of the password by anyone, without also requiring recompiling the code. – vakus Jun 8 '18 at 22:38
  • Well, obviously it would not be stored as plaintext! For example, it could be hashed and then a hashed input could be compared to it. The main point of my question is how can I do this in a secure way that cannot be reversed. – Baked Potato Jun 8 '18 at 22:51
  • I do not assume you would store the passwords as plain text, but there is no way to stop anyone from brute forcing a password. Sounds to me that you more look for security through obscurity at this point, which isn't a good idea either. As I have also said in the answer, you should store the hash of the password OUTSIDE the code, for example in separate file. This file SHOULD NOT be uploaded as part of source code. This solves the issue of attacker getting the password hash in the first place – vakus Jun 8 '18 at 23:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.