Encryption isn't the best method of storing a password for one very large reason: the decryption key has to be stored somewhere. If the server ever were to be hacked, the decryption key would be need to be stored somewhere in the database, meaning the server is practically storing passwords in plaintext.
The far better way to store a password is to use a cryptographic hash function to store them. Hashing, unlike encryption, cannot be reversed, meaning the only way for an attacker to steal a password is to brute force it.
I'd specifically recommend you use a cryptographic hash function designed for passwords, like Argon2. There are prebuilt JavaScript implementations of Argon2, like argon2(FYI: this requires the usage of await).
Here's a little JavaScript pseudocode written with this library:
const argon2 = require("argon2");
const db = require("key-value-database")
async function UserSignup(login, password) {
var hash = await argon2.hash(password);
db.store(`users.${login}.hash`, hash);
}
async function UserLogin(login, password) {
var hash = db.get(`users.${login}.hash`);
return await argon2.verify(hash, password);
}Here's a small usage example:
await UserSignup("mashedpotatoes96", "~.FWf&}O0|DA\XvD");
await UserLogin("mashedpotatoes96", "~.FWf&}O0|DA\XvD"); // true
await UserLogin("mashedpotatoes96", "password123"); // false
Encryption isn't the best method of storing a password for one very large reason: the decryption key has to be stored somewhere. If the server ever were to be hacked, the decryption key would be need to be stored somewhere in the database, meaning the server is practically storing passwords in plaintext.
The far better way to store a password is to use a cryptographic hash function to store them. Hashing, unlike encryption, cannot be reversed, meaning the only way for an attacker to steal a password is to brute force it.
I'd specifically recommend you use a cryptographic hash function designed for passwords, like Argon2. There are prebuilt JavaScript implementations of Argon2, like argon2(FYI: this requires the usage of
await).Here's a little JavaScript pseudocode written with this library:
Here's a small usage example: