What is safer?
I can use either one as I’m using CodeIgniter, but with Sha1, I can’t reverse if I ever needed to for some odd reason like I can with encryption.
But I’m still somewhat new to PHP, so if there is a way I can possibly do something like display the sha1 hashed password as stars, so if say your password is “lala123” it would show this to me: “*******” and never ever be able to be shown “lala123”, is it possible to do that with sha1? If so, please help me, otherwise I’ll use encryption, but only if it’s safe to use for passwords. Please let me know 🙂
Hashing is considered more secure for the very reason that even you cannot restore the password. If you password database is compromised, and the password encryption is reversible, the baddie might decrypt them, especially if the code that does the decryption has been compromised as well. SHA1 is not reversible by design.
You’re not supposed to display the password in the UI – ever. The * are just that – an arbitrary number of stars. Disclosing the length of a user’s password constitutes in itself a considerable hint to a would-be guesser.