Sending password safely from the front-end to the

Question

I've encrypted a password field in my DB by MD5, and I handle it encrypted in my back-end, but when user types their password in, it is in plain text.

Is there a safe way to pass the password from the front-end to the back-end? MD5 doesn´t have sense in this case...

NOTE: I'm using HTTPS and the POST Method.

Answer 1

While the accepted answer correctly describes how you should STORE passwords on the server side, the question was actually on how to transmit password safely from client to server.

I just want to make clear that the salting and hashing is done at the server side. The client would just sent the clear text password over a secure connection (HTTPS) to the server.

Answer 2

You can think about the following steps to protect the password:

1. Use HTTPS preferably with HSTS to protect the passwords during transport;

2. Use a password hash such as bcrypt instead of MD5 to protect the password on the server.

   • HASH passwords with salt;
   • use a high work factor for bcrypt.

MD5 is not the best way to hash. MD5 is not considered secure anymore.

MD5 is not encryption; don't encrypt passwords, hash them, encryption can be decrypted, hashing cannot be reversed.