Home/ Questions/Q 6788257
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-26T17:27:51+00:00

Currently I am developing an application with 3 roles: 1 for customers, 1 for

  • 0

Currently I am developing an application with 3 roles: 1 for customers, 1 for the company employees and another one for a Super Admin.

Is it a good practice to allow Super Admin users to see/edit the users’ passwords through the UI? Or should it only be modified directly through the DB?

UPDATE: I am using asp.net membership provider and MySQL. Therefore, there is a table in the DB called my_aspnet_membership which stores two fields: Password and PasswordKey. The field PasswordKey seems to be the encrypted password. However, the Password field is stored in plain text. So, can anyone tell me why this is designed in this way if it is not a good practice? Thank you all for your responses!

UPDATE: For those who asked if it really stores the password in two different fields:

enter image description here

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    No user should be allowed to see the Plaintext password of any other user whatsoever. The password must be encrypted atleast if not hashed even in the database.
    You MAY allow the super admin to change any user’s password, but allowing him to see it in plaintext is taboo.

    EDIT: Are you absolutely certain the password field stores the password in plaintext, while there exists another passwordkey field? Because, it sounds similar to a ‘salt’ mechanism to me. Where, the password is first encrypted with one key, and then re-encrypted with the passwordkey field.

    EDIT 2: I am now almost absolutely certain that your database is using a salted password. Salted passwords are often used to increase the security level of the database. For more information on salt, check this.

    • 0