Question

I am writing an android password manager application and i want to store the master password somewhere but i don’t know where. Should i encrypt the master password that the user gives me with a hard coded password that i choose and then store it to the database? or should i do something else?

Answer 1

You should never store unencrypted passwords.

For passwords, that you can’t encrypt safely (because you have to store the decryption key somewhere), you should only store a unreversible hash of it.

That way you can compare the password to the hash when the user gives you the password. If it matches, you can decrypt the stored user:password pairs with the given password.

PS: Don’t forget to salt the hash and please do it properly.