Should password hash be stored in binary or hexadecimal number?

user_748789 0
Viewed 3698

I usually store it in hexadecimal number but realize I could save half of the space if I store it in binary inside MySQL. Are there any issues I should be aware of if I decide to store it in binary?

hash passwords security mysql php
4 Answers

Disclaimer: Let's be real, this question must be on the border of being closed as purely opinion based. So any answer you get is a matter of preference and expierence.

Just to add my common sense answer to this question: You should store it the way you get it from your encryption tool/method.

Any good encryption has an encrypt and a decrypt or compare method. Normally the output of the encrypt is what you need to pass as input to the decrypt/compare.

Whatever output encrypt is producing, should be the prefered way of storing it.

You can convert the output to whatever you like, whether it is binary, hex, base64 or write it down using pen and paper, the encrypted value will not become more or less secure. Somebody that finds the value, will need the encryption keys to decrypt it.

But everytime you convert something, you also need to convert it back to it's previous state. Which means you add a new layer of potential problems and add overhead on the whole proces. However negligible it might be, it still is more complex/slower then not doing it at all.

user_4349490

The main motive when it comes to password is How secured it is rather than just scaling for the sizes or space taken by it in the databases and because of this your password must contain all the security entities such as Algorithm , Algorithm Options (for eg: time cost, memory cost, threads),Salts,Hashed Password.This all together make your password far more stronger than a simple hex or binary password.

References:

Safe Password Hashing

Password Hash

And as per the first link The suggested algorithm to use when hashing passwords is Blowfish, which is also the default used by the password hashing API, as it is significantly more computationally expensive than MD5 or SHA1, while still being scalable.

You can use the

echo password_hash("rasmuslerdorf", PASSWORD_DEFAULT);

Output

$2y$10$.vGA1O9wmRjrwAVXD98HNOgsNpDczlqm3Jq7KnEd1rVAGv3Fykk1a

Here your password consists of all Algorithm , Algorithm Options (for eg: time cost, memory cost, threads),Salts,Hashed Password

user_106521940
Related