-1

What is the safest way that I could could hash/encrypt a password for my website?

Techno
  • 3
  • 1

2 Answers2

2

"Safest" depends on the circumstances and context; there is no one-size-fits-all absolute answer.

However, there is a lot of accumulated knowledge on the subject. Basically, you want a one-way hashing process, so that someone who gets some read access to your server does not immediately obtains a usable copy of the passwords. The hashing process should also deter parallel attacks (that's what salt are used for) and be configurably slow (as slow as you can tolerate on your machine, as an attempt to slow down the attacker too).

Read this first; it should answer most of your questions and provide links.

Community
  • 1
Tom Leek
  • 168,808
  • 28
  • 337
  • 475
-2

There isn't really a safest way, but these things are the best tips I can offer:

  • Use a one-directional hash, not an encryption, and compare hashed user input to stored hashes.
  • Add a salt. Instead of hashing 'password', which could easily be looked up in a dictionary of hashes, hash something like 'SALTpassword', where SALT is a string of characters you decide upon, and keep secret.
  • Constantly review the system you end up using, keep an eye out for suddenly found vulnerabilities
  • Enforce a policy of using decent passwords.

^ That should get you off to a good start, some reading up on password theory and opinion would also be a good idea.

Owen
  • 1,066
  • 5
  • 9
  • You're welcome ;) – Owen Oct 16 '13 at 16:57
  • 1
    Suggesting to do a simple hash of the concatenation of a salt and the password is rarely a good one; talking about "secret salts" is just confusing as well (salts are not secret, keys are). – Tom Leek Oct 16 '13 at 17:00
  • Ok fair point. What I would mean, for reference, is that the OP wouldn't be routinely revealing the salt they used. Given the entry level of the question, I didn't think a deeper delve into password theory was a good move, but fair point that there is much more password hashing than just salting. – Owen Oct 16 '13 at 17:03
  • 1
    A salt should be globally unique for each password. They should not be reused. When you use a single piece of data that you hash with all passwords as you describe, it is more appropriately known as a pepper, and while it may be useful, it is not an adequate replacement for an actual salt, as it will cause identical passwords to produce identical hashes. – Xander Oct 16 '13 at 17:08