The answer is **yes, you should always hash this**. Why do we hash stuff like passwords at all? Basically because people may use the same password for multiple services, and to prevent people from logging in with read-only database access. So don't you think the user's first pet or mother's maiden name is also data that he would use across multiple services? Or that could potentially be used for social engineering attacks? Or could be used to reset the password and also gain access? For that reason, you should protect answers to security questions against attackers (and admins!) the same way as you do with passwords. **Why not encrypt it?** Encryption is reversible, it makes it possible to access the data while there is no need to. One of the cases you're trying to prevent by protecting the database data, is a case where the server is compromised, or where an insider has bad intentions. In both cases, they could use the decryption key to reverse the protection. With [decent hashing](http://security.stackexchange.com/questions/211/how-to-securely-hash-passwords), this is no longer possible.