0

What's the alternative to storing plain-text passwords in a Database?

For example, I'm using Node.js to get a POST request for signing up / logging in a user from a webpage.

When signing up a user, I get the parameters for the email and password from the request, and query it through the (Node.js) server. It then stores the data in SQL.

What's a way to not store plain-text passwords in the database? (because people recommend it but don't explain the alternative)

Edit: I already know about SQL injection, so I check the request data in the server.

18
  • Store a cryptographically secure hash only that is not reversible to the password itself. Then when you want to test a password to see if it matches, you hash it the same way and compare the hashes. This way you never store the actual password.
    – jfriend00
    Nov 13 '21 at 0:33
  • 1
    So the best I can find right now is npm.io/package/argon2, which is in the npm repository and will do better than the NodeJS crypto library.
    – forest
    Nov 13 '21 at 0:47
  • 3
    OP, I think this is what you are looking for: npmjs.com/package/password_hash
    – mti2935
    Nov 13 '21 at 0:57
  • 1
    @ParkingMaster No problem. BTW, cool game - parkingmaster.w3spaces.com
    – mti2935
    Nov 13 '21 at 2:40
  • 1
    @ParkingMaster I don't code in node.js, so I don't know. But, PHP has a built-in function password_hash() that is used extensively for password salting and hashing in part because it is future tolerant and backwards compatible. See stackoverflow.com/questions/30279321/…. When I saw your question, it occurred to me that a function like this in node.js is exactly what you need, and a quick Google search lead me to the page that I posted above. I hope this helps.
    – mti2935
    Nov 13 '21 at 16:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.