I'm trying to figure out the best way to encrypt passwords for a forums site I'm working on.
I've decided I'm going to use an encryption such as blowfish. From my understanding, you have a key, and the text you want to encrypt. The encryption then uses the key to encrypt the text. When a user creates an account, I plan on generating a UUID for them. That will be the primary key when they're put in the database with their encrypted password.
Now, I don't plan on letting the users be able to find out their UUID, because it will only be stored in PHP sessions. But, let's say, somehow someone finds out the user's UUID.
Would it then be possible to decrypt their password? Would they even be able to find the UUID from a php session? If there is an issue with this concept, should I generate a key to use and store it in the database with their UUID and password?
Sorry if the question's confusing, I'm not very good at putting my thoughts into words. Thank you in advance.