Preferred Method of Storing Passwords In Database Preferred Method of Storing Passwords In Database sql-server sql-server

Preferred Method of Storing Passwords In Database


I store the salted hash equivalent of the password in the database and never the password itself, then always compare the hash to the generated one of what the user passed in.

It's too dangerous to ever store the literal password data anywhere. This makes recovery impossible, but when someone forgets or loses a password you can run through some checks and create a new password.


THE preferred method: never store passwords in your DB. Only hashes thereof. Add salt to taste.


I do the same thing you've described, except it is stored as a String. I Base64 encode the encrypted binary value. The amount of space to allocate depends on the encryption algorithm/cipher strength.

I think you are doing it right (given that you use a Salt).