Android encrypt edittext input

Question

I'm building Android app that is intended for exactly one user per installation. Application needs to store username and password.

After validation, entered username and password are stored in shared preferences and both of them need to be entered every time the app starts.

Username field:android:inputType="textCapSentences"

Password field:android:inputType="textPassword"

My question is: what is the least painful way to encrypt/decrypt both values.

Encryption process doesn't have to be top notch since the application is for school project.

I would use a md5 or sha one way hash. – RamithDR Sep 03 '16 at 19:32 — RamithDR, Sep 03 '16 at 19:32

score 3 · Accepted Answer · answered Sep 03 '16 at 19:30

3

There is no need to encrypt/decrypt the inputs.

In order to make them unreadable you just have to use a good one-to-one Hash-Function.

Let's say your hash function is 'h':

To store your values:

// Pseudo
SharedPrefs.put(USERNAME, h(input_username));

To validate your values:

// Pseudo
SharedPrefs.get(USERNAME).equals(h(input_username));

answered Sep 03 '16 at 19:30

Erik

73
6

1

@Jurza Never ever ever write your own hash function. Use SHA256 etc. – Luke Joshua Park Sep 03 '16 at 20:27

score 1 · Answer 2 · edited May 23 '17 at 12:08

1

Never never encrypt passwords, use hashes

you can try this: Hash String via SHA-256 in Java

Save the password hash on your database, when the user logs in, hash the input, if the hash on your database is equal to the input hash then you know that the user typed the right password

edited May 23 '17 at 12:08

Community

1
1

answered Sep 03 '16 at 19:32

Tiago Oliveira

1,582
1
16
31

Can you explain why password encription is not a way to go? – CleanCoder265 Sep 03 '16 at 19:37
If you use encryption anyone can decompile your app, see your password and decrypt your users password, if you use a good hashing + salt it's almost impossible to get the password in one life time, cracking a hashed password takes a lot of years even with a super pc – Tiago Oliveira Sep 03 '16 at 19:42

score 0 · Answer 3 · answered Sep 03 '16 at 19:38

Since you want to encrypt/decrypt the credential(username and password) every time when user starts the app. I'ld recommend you to use [Account Manager][1]

[1]: https://developer.android.com/reference/android/accounts/AccountManager.html that will handle it as well as secure.

Android encrypt edittext input

3 Answers3