# Emailing lost passwords

**URL:** <https://www.ruby-forum.com/t/emailing-lost-passwords/51902>\
**Category:** Rails\
**Created:** [January 9, 2006, 2:12am UTC](https://www.ruby-forum.com/t/emailing-lost-passwords/51902 "2006-01-09T02:12:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gerry\_Shaw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/4491bb/32.png) [@Gerry\_Shaw](https://www.ruby-forum.com/u/Gerry_Shaw)\
**Post date:** [January 9, 2006, 2:12am UTC](https://www.ruby-forum.com/t/emailing-lost-passwords/51902/1 "2006-01-09T02:12:21Z")

</div>

This might be a stupid question and if so then humor me with smart  
remark and the answer 🙂

I want to have a feature on my site that allows me to email forgotten  
passwords back to the user (like what Backpack does). Now I’m currently  
encrypting the user’s password + salt before saving to the database  
using code borrowed from the LoginGenerator.

The question I have is there any way to get the user’s password after if  
it’s been SHA1’ed or do I have store the user’s password as plain text  
in the database?

If I have to store is plain text, isn’t that a bit insecure? And if so  
why does backpack (and I’m assuming others do it?)

If I want to have the password encrypted in the database is my only  
option to change their password ot a new value?

Thanks!

---

<div class="post-metadata">

**Author:** ![Gerry\_Shaw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/4491bb/32.png) [@Gerry\_Shaw](https://www.ruby-forum.com/u/Gerry_Shaw)\
**Post date:** [January 9, 2006, 2:31am UTC](https://www.ruby-forum.com/t/emailing-lost-passwords/51902/2 "2006-01-09T02:31:25Z")

</div>

On Mon, Jan 09, 2006 at 02:12:21AM +0100, Gerry Shaw wrote:

> in the database?
> 
> If I have to store is plain text, isn’t that a bit insecure? And if so  
> why does backpack (and I’m assuming others do it?)
> 
> If I want to have the password encrypted in the database is my only  
> option to change their password ot a new value?
> 
> Thanks!

Nope, you can’t un-SHA1 the password. The only way to send it back is  
to store it plain text (or use encryption, which is fairly pointless).  
It’s marginally less secure, if someone gets access to your database; at  
which point they’ve got all the data anyway. It’s a tradeoff of  
convenience for a slight decrease in security.

-Scott

---

<div class="post-metadata">

**Author:** ![Gerry\_Shaw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/4491bb/32.png) [@Gerry\_Shaw](https://www.ruby-forum.com/u/Gerry_Shaw)\
**Post date:** [January 9, 2006, 2:34am UTC](https://www.ruby-forum.com/t/emailing-lost-passwords/51902/3 "2006-01-09T02:34:24Z")

</div>

Thanks for the sanity check (and quick reply). Just checking to make  
sure I wasn’t missing anything obvious.

---

<div class="post-metadata">

**Author:** ![Gerry\_Shaw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/4491bb/32.png) [@Gerry\_Shaw](https://www.ruby-forum.com/u/Gerry_Shaw)\
**Post date:** [January 9, 2006, 2:37am UTC](https://www.ruby-forum.com/t/emailing-lost-passwords/51902/4 "2006-01-09T02:37:27Z")

</div>

For security reasons I’ve always taken the approach of using an  
algorithm to  
generate a new strong password, change the user’s password, and then  
email  
that to the user. I think most users will appreciate the fact that  
you’ve  
created a new secure password for them. At least it gives them a  
feeling  
that their password is not out in the open.

Michael T.