When developing login module for a web application, do you suggest to keep the username and password in a keystore? Lets assume the keystore was kept in a very safe place in web server.

1 Answer 1


It's never a good idea to store passwords on the server anywhere, keystore or otherwise. It doesn't matter how safe you intend to keep the passwords -- you are still storing them somewhere, which introduces a set of possible vulnerabilities which are completely avoidable.

You should either be offloading the login process to an external provider (for exmaple, OpenID) or you should only be storing is password hashes (and associated salts). That way even if your server is compromised, the passwords would not be available without some brute force password cracking software (which still won't get strong passwords -- and won't get many weaker ones if you use a good password hashing algorithm like BCrypt).

As for where to store the password hashes, it doesn't really matter as long as it's meets your specifications for permanence and performance. Most people use a typical database to store these, but a simple key-value store (with permanence) would be fine for most applications.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.