Will knowing clear text value behind encrypted data help hacker find password? I am building an Android App where I will be storing some encrypted data in a database. To ensure that the user has entered the right password, I have encrypted my own secret phrase and stored it in the database. Thus, I try to decrypt that using the entered user password to see whether it matches the clear text form.

Given that Android apps can be decompiled, to know my secret phrase, and assume encryption technique be figured out, will it be more useful for a potential hacker to know the clear text? I am using password based key generation (10,000 iterations) to do AES encryption.
OK, so what you are doing right now is the following:


The user enters the password.
It gets run through a PBKDF.
The resulting key is used to verify that a stored string decrypts to "foo bar"
If it does, the derived key is used to decrypt the database.


While this should work and there's no risk with publishing "foo bar" because the data stays inaccessible. It would be a nice idea (from a design point of view) to use a proper verification primitive here. This can be something simple, like verifying that the stored HMAC-value is actually the HMAC of an empty string using the derived key. 

While an attacker can swap out said encrypted string in theory, this would gain him nothing with regards to the actual data and only allow him to inconvience the user a bit. Now you could argue that using such a string could inconvience the attacker, but all he would have to do, is to reverse-engineer the application to find the string.

Also note that you must not use the an easier password-based key derivation function for either the password verification or the database decryption because the attacker then gets to chose against which he wants to brute-force.