# Storing encrypted passwords in the database **URL:** \ **Category:** Rails\ **Created:** [January 18, 2008, 12:02am UTC](https://www.ruby-forum.com/t/storing-encrypted-passwords-in-the-database/126402 "2008-01-18T00:02:43Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [January 18, 2008, 12:02am UTC](https://www.ruby-forum.com/t/storing-encrypted-passwords-in-the-database/126402/1 "2008-01-18T00:02:43Z")
Hi, I have a password column in my customer table. Right now, the scaffolding saves the passsword in plain text. If I wanted to store the password in an encrypted form, what is the easiest way of doing that? Much thanks, - Dave ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [January 18, 2008, 12:14am UTC](https://www.ruby-forum.com/t/storing-encrypted-passwords-in-the-database/126402/2 "2008-01-18T00:14:24Z")
Have a look at what acts\_as\_authenticated/restful\_authentication does. On Jan 18, 2008 9:32 AM, removed\_email\_address@domain.invalid \< removed\_email\_address@domain.invalid\> wrote: > > – Ryan B. > **[frozenplague.net](http://www.frozenplague.net)** > > This domain may be for sale! Feel free to add me to MSN and/or GTalk as this email. ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [January 18, 2008, 12:59am UTC](https://www.ruby-forum.com/t/storing-encrypted-passwords-in-the-database/126402/3 "2008-01-18T00:59:28Z")
Ditto on the plugins Ryan mentioned. It’s important to note that you shouldn’t store the encrypted password – instead, you should store a salted hash, which is much more secure. There are lots of resources that discuss how and why. ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [January 18, 2008, 1:52am UTC](https://www.ruby-forum.com/t/storing-encrypted-passwords-in-the-database/126402/4 "2008-01-18T01:52:34Z")
I would recommend the same, except SHA256 instead of the SHA1 that restful authentication uses. ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [January 18, 2008, 11:26pm UTC](https://www.ruby-forum.com/t/storing-encrypted-passwords-in-the-database/126402/5 "2008-01-18T23:26:44Z")
Those plugins generate code that you can put anywhere. If you want to keep an existing table, you could add all of restful\_authentication’s fields to that table and just copy the generated User model code into your Customer model. Or, it might be easier to do it the other way around. On Jan 18, 3:09 pm, “removed\_email\_address@domain.invalid” ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [January 19, 2008, 12:59am UTC](https://www.ruby-forum.com/t/storing-encrypted-passwords-in-the-database/126402/6 "2008-01-19T00:59:33Z")
I like this idea (doing it the other way around, that is). I have a follow up question on the subject of encryption/salted hashes. If I want to (for lack of a better word) encrypt some of the other fields in the database, can I use the plugin(s) above to do that? Otherwise, how would you recommend I get it done? Thanks, - Dave ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [January 18, 2008, 11:10pm UTC](https://www.ruby-forum.com/t/storing-encrypted-passwords-in-the-database/126402/7 "2008-01-18T23:10:15Z")
Regarding the resultful\_authentication (since it seems acts\_as\_authenticated is deprecated), how would I configure my app so that restful\_authentication uses an existing table I have (customer) with its fields (customer.username, customer.password)? Thanks, - Dave ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [January 19, 2008, 1:35am UTC](https://www.ruby-forum.com/t/storing-encrypted-passwords-in-the-database/126402/8 "2008-01-19T01:35:12Z")
You could use the same methods in those plugins. The way it works is the data is run through a one-way hashing function. You store this hash in the database. Of future requests, you must hash the user input then compare it to the hash you have in the database. It’s one way though, so there is no feasible way to know what the original data was - only the hash that was derived from it. This is why most authentication systems require you to “reset” your password instead of just telling you the original - they don’t know the original password. On Jan 18, 4:58 pm, “removed\_email\_address@domain.invalid”