<p>What is a good, simple encryption scheme for protecting passwords in a database?  I don't necessarily need anything that's hyper-secure nor do I need anything that's lightning fast, but those things would be nice.  Primarily, I just want something that's easy to implement without being terribly slow or insecure.</p>

[{'answer_id': 30949, 'author': 'mk.', 'author_id': 1797, 'author_profile': 'https://Stackoverflow.com/users/1797', 'pm_score': 3, 'selected': False, 'text': '<p><a href="http://en.wikipedia.org/wiki/MD5" rel="noreferrer">MD5</a> or <a href="http://en.wikipedia.org/wiki/SHA-1" rel="noreferrer">SHA1</a> + salt. </p>\n'}, {'answer_id': 30951, 'author': 'Dale Ragan', 'author_id': 1117, 'author_profile': 'https://Stackoverflow.com/users/1117', 'pm_score': 2, 'selected': False, 'text': '<p>Use the <a href="http://en.wikipedia.org/wiki/SHA-1" rel="nofollow noreferrer">SHA</a> one way hashing algorithm along with a unique salt.  It is the main algorithm I use for storing my passwords in the database.</p>\n'}, {'answer_id': 30952, 'author': 'Keith', 'author_id': 905, 'author_profile': 'https://Stackoverflow.com/users/905', 'pm_score': 3, 'selected': False, 'text': '<p>If you use MD5 or SHA1 use a salt to avoid rainbow table hacks.</p>\n\n<p>In C# this is easy:</p>\n\n<pre><code>MD5CryptoServiceProvider hasher = new MD5CryptoServiceProvider();\nstring addSalt = string.Concat( "ummm salty ", password );\nbyte[] hash = hasher.ComputeHash( Encoding.Unicode.GetBytes( addSalt ) );\n</code></pre>\n'}, {'answer_id': 30958, 'author': 'Joel Coehoorn', 'author_id': 3043, 'author_profile': 'https://Stackoverflow.com/users/3043', 'pm_score': 0, 'selected': False, 'text': '<p>If you\'re using SQL Server, there\'s the HashBytes function:  </p>\n\n<p><a href="http://msdn.microsoft.com/en-us/library/ms174415.aspx" rel="nofollow noreferrer">http://msdn.microsoft.com/en-us/library/ms174415.aspx</a></p>\n'}, {'answer_id': 30967, 'author': 'Justin Bennett', 'author_id': 271, 'author_profile': 'https://Stackoverflow.com/users/271', 'pm_score': 0, 'selected': False, 'text': '<p>I second the vote for MD5 or SHA with a salt.  Any of the major web development languages have functions built-in for computing the hash (in PHP, for example, the mcrypt package contains the necessary functions).</p>\n'}, {'answer_id': 30971, 'author': 'TJ Seabrooks', 'author_id': 3022, 'author_profile': 'https://Stackoverflow.com/users/3022', 'pm_score': 0, 'selected': False, 'text': '<p>You need to be using an uni-directional hash algorithm like SHA-1 suggested above with a salt. I would suggest this site for more information. It includes some sample code / implementation.\n<a href="http://www.obviex.com/samples/hash.aspx" rel="nofollow noreferrer">http://www.obviex.com/samples/hash.aspx</a></p>\n'}, {'answer_id': 30979, 'author': 'Neall', 'author_id': 619, 'author_profile': 'https://Stackoverflow.com/users/619', 'pm_score': 5, 'selected': True, 'text': '<p>As mk says, <s>SHA1 or MD5 are the standard ones, along with SHA2</s>.</p>\n<hr />\n<p>Update: As processors have gotten faster over the years, hashes have gotten more brute-forceable. It\'s now recommended you use <a href="https://en.wikipedia.org/wiki/Bcrypt" rel="nofollow noreferrer"><code>bcrypt</code></a>.</p>\n<p>Another update: <code>bcrypt</code> is still probably good, but if I was writing a new system today I would use <a href="https://en.wikipedia.org/wiki/Scrypt" rel="nofollow noreferrer"><code>scrypt</code></a>.</p>\n<hr />\n<p>What you want is more generally called a cryptographic hash function. Cryptographic hashes are designed to be one-way (given the resulting hash, you shouldn\'t be able to derive the original input). Also, the likelihood of two arbitrary strings having the same hash (known as a hash collision) should be low (ideally 1/number of hash values).</p>\n<p>Unfortunately, just because your passwords are hashed doesn\'t free you from having to try really hard to keep the hashed versions safe. Far too many people will use weak passwords that would be vulnerable to an off-line brute-force attack.</p>\n<p>Edit - several people have also already pointed out the importance of using a salt. A salt is a constant value that you mix in with the input before using the hash function. Having a unique salt prevents off-line attackers from using pre-computed tables of common passwords (rainbow tables) to brute-force your passwords even faster.</p>\n'}, {'answer_id': 30991, 'author': 'graham.reeds', 'author_id': 342, 'author_profile': 'https://Stackoverflow.com/users/342', 'pm_score': 3, 'selected': False, 'text': '<p>Easy: <a href="http://www.mindrot.org/projects/" rel="noreferrer">BCrypt</a>.</p>\n'}, {'answer_id': 139073, 'author': 'Christian Davén', 'author_id': 12534, 'author_profile': 'https://Stackoverflow.com/users/12534', 'pm_score': 0, 'selected': False, 'text': "<p>The key to better security, I think, is to use dynamic salts. This means that you generate a random string for each new user and use that string to salt the hash. Of course, you need to store this salt in the database to be able to verify the password later (I don't encrypt it in any way).</p>\n"}, {'answer_id': 407442, 'author': 'Mark Davidson', 'author_id': 50866, 'author_profile': 'https://Stackoverflow.com/users/50866', 'pm_score': 0, 'selected': False, 'text': '<p>For a non-reversible encryption I would most definitely go with SHA256 or SHA1. MD5 has quite a lot of collisions now and a lot of effort has been put into breaking it, so not a good one to use.</p>\n'}, {'answer_id': 407488, 'author': 'Brent.Longborough', 'author_id': 9634, 'author_profile': 'https://Stackoverflow.com/users/9634', 'pm_score': 0, 'selected': False, 'text': '<p>If you want to future-proof your solution, I\'d recommend SHA256 or SHA512. Cryptographic geekworld is getting the jitters about MD5 and, to a slightly lesser extent, SHA1.</p>\n\n<p>Or, if you can, wait for <a href="http://csrc.nist.gov/groups/ST/hash/sha-3/index.html" rel="nofollow noreferrer">SHA-3</a></p>\n'}]
['https://Stackoverflow.com/questions/30946', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/2147/']