Are Passwords encrypted on the client side or server side?

A

Anonymous

Guest
Case 1: New User Registration
Case 2: Existing User Login

In either case is the User Password encrypted on the Client Side or the Server Side?

Somehow I thought it was encrypted on the client side BUT after discovering the PHP API/Functions...
- password_hash()
- password_verify()

I read this online...
"Remember that you store the hashes in a database, but it’s the plain password that you get when a user logs in.
The password_verify() function takes a plain password and the hashed string as its two arguments. It returns true if the hash matches the specified password."

So, is it correct that no encryption occurs on the client side?

And that the process is. sort of like the steps below...

New User Account Creation:
1 - New User fills out registration form
2 - that data is sent un-encrypted to the server
3 - the password is then encrypted/hashed via password_hash()
4 - and then stored (encrypted) with the username in the username_password table

Existing User Login:
1 - Existing user goes to log-in page and enters username and password
2 - that data is sent un-encrypted to the server
3 - password_verify() then takes the un-encrypted password and compares it to the hashed password in the table
4 - and returns 'true' if they match
5 - and you go on from here...

Thanks for any help.
 
There is no encryption done on either side. Passwords are hashed by password_hash. The hash is stored in the DB. On login, the user supplied password is hashed and compared to the hash in the DB with password_verify.
 
Thanks for the reply.

We had already planned to use password_hash() and password_verify()

But that is done on the server side. I've come to the conclusion that the best way to protect passwords passed from the client to the server is via an SSL connection. Of course this is an expense as the site has to buy an SSL certificate.

BTW, I would think that 'hashing' is in fact a form of encryption... aka... making the original data difficult to obtain by anyone other than who it was intended for.

Thanks.
 
You must log in or register to reply here.
Back
Top