Sha1 Or Encryption for Passwords

Question

What is safer?

I can use either one as I'm using CodeIgniter, but with Sha1, I can't reverse if I ever needed to for some odd reason like I can with encryption.

But I'm still somewhat new to PHP, so if there is a way I can possibly do something like display the sha1 hashed password as stars, so if say your password is "lala123" it would show this to me: "*******" and never ever be able to be shown "lala123", is it possible to do that with sha1? If so, please help me, otherwise I'll use encryption, but only if it's safe to use for passwords. Please let me know :)

score 2 · Accepted Answer · answered Jun 25 '12 at 01:34

Hashing is considered more secure for the very reason that even you cannot restore the password. If you password database is compromised, and the password encryption is reversible, the baddie might decrypt them, especially if the code that does the decryption has been compromised as well. SHA1 is not reversible by design.

You're not supposed to display the password in the UI - ever. The * are just that - an arbitrary number of stars. Disclosing the length of a user's password constitutes in itself a considerable hint to a would-be guesser.

Okay thanks for that information :) I won't use that method then, I'll continue using SHA1 — WittyPleb, Jun 25 '12 at 01:43

score 2 · Answer 2 · edited May 23 '17 at 10:09

2

Neither. You should use hashing to keep the passwords secure in case someone gets the password database. But the consensus answer seems to be to use bcrypt, described in this answer. It is a hash function based on blowfish with variable cost so you can tune security versus performance.

edited May 23 '17 at 10:09

Community

1
1

answered Jun 25 '12 at 01:43

John Watts

8,717
1
31
35

Sha1 Or Encryption for Passwords

2 Answers2