I started making a simple user authentication program just for fun, and I realised I don't know how to keep safe the files that will store all the usernames and passwords. This got me thinking.

What is stopping me from viewing sensitive information about the different software installed on my computer. How is this information stored/encrypted?


Passwords are stored on the computer as hashes, those are only one-way. You can hash a value, but you can't retrieve the value back. The authentication works like this :

  1. Create password, hash it, then store it.
  2. The user tries to login, the password he puts in gets hashed, and is then compared to the hash stored on the computer.

Popular hashing algorithms are: Sha-2, MD5, NTLMv2 (windows 7 and 8 use this one)

Edit: Also, an addition:

Usually you hash something multiple times, for example 1000 times, this way it is longer to compute, and brute force attacks (trying each possible password, and comparing it with your hash) take longer.

You also use a salt, which is stored unencrypted next to the password, which is just some high number, and differs for each password. This way when there are two similair passwords, the attacker won't notice it.

  • Note that "popular" is not the same as "good". Those are all bad choices for hashing passwords: they're simply too fast to compute, making brute-force attacks easy. If you don't need to share your password hashes with other software, you want something like bcrypt or scrypt. – Mark Feb 15 '15 at 1:38
  • In fact, that's why I used this word. – Cube Feb 15 '15 at 10:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.