Home/ Questions/Q 6794691
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-26T18:15:10+00:00

I have a SQL Server 2005 database for a web site that stores user

  • 0

I have a SQL Server 2005 database for a web site that stores user passwords in plaintext, and I would like to hash and salt them. I know how to use the HashBytes function to get and compare hashes, but I don’t know the best way to go about converting the existing password column data. It’s currently stored as a varchar(50) column and I would like to use binary(20) since I’m planning on using SHA-1.

I was thinking about SELECT INTO a temporary table, ALTER the existing column type, then INSERT the hashed and salted passwords back where the user ID’s match. Is this a valid approach? Is there a way to do it in-place without a temp table?

Thanks!

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You could just store the binary info as a hex string. This has some benefits:

    • Allows easy in-place UPDATE query
    • No need for temp tables
    • No need to change the structure of the table (your end result is a string)

    I suggest writing functions to help you with the salting/hashing/hex-conversion (and vice versa.)

    • 0