how to store java application password safely in database

Question

I have java application that connects to other tools via API. currently all password are stored locally in the application.

I want to store them safely in database, hash password within database and decrypt when I retrieve passwords at run time. is this the best approach ?

thanks

What kind of application do you have? Do you use any frameworks? — arnonuem, Jul 02 '19 at 12:48
Possible duplicate of [Where to store database password secure in java desktop application](https://stackoverflow.com/questions/6166692/where-to-store-database-password-secure-in-java-desktop-application) — Exceptional NullPointer, Jul 02 '19 at 14:02
Related: https://stackoverflow.com/questions/1054022/best-way-to-store-password-in-database — Mark Rotteveel, Jul 06 '19 at 18:23

score 0 · Answer 1 · answered Jul 02 '19 at 12:45

0

You can use Asymmetric Cryptography or any other to store securely in database

answered Jul 02 '19 at 12:45

Sushil Mittal

494
4
10

score 0 · Answer 2 · answered Jul 02 '19 at 12:49

I would create a Spring-Boot Application. Spring uses a BCryptEncoder /-decoder to store passwords in a database in a secure way.

If you don`t want to use Spring maybe the following link can help you.

https://www.stubbornjava.com/posts/hashing-passwords-in-java-with-bcrypt

score 0 · Answer 3 · answered Jul 02 '19 at 13:17

Another alternative if only administrators have access to the server the application is running on is to provide the secrets (passwords) as environment variables.

The most basic way of accessing these is System.getEnv(String envKey). For example:

export SOME_ENV_VARIABLE="your secret"; java -jar yourapplication.jar;

If you're using AWS or something similar they often have tools for storing these secrets in a secure way.

score 0 · Accepted Answer · answered Jul 05 '19 at 16:22

0

You can use cryptographic hashing for storing password.

https://auth0.com/blog/hashing-passwords-one-way-road-to-security/

If you want additional security then you can add salt to hashing.

https://auth0.com/blog/adding-salt-to-hashing-a-better-way-to-store-passwords/

answered Jul 05 '19 at 16:22

Vikas

16
1

do you have a java version? – Lidor Eliyahu Shelef Feb 02 '20 at 09:47

how to store java application password safely in database

4 Answers4