Take the 2-minute tour ×

I am looking for a way to store a key used for password encryption. I am using a mysql db which would store a user name and an encrypted password that would be encrypted using AES_ENCRYPT(str,key_str). But where to store the key for password decryption to make it safe?

share|improve this question

2 Answers 2

up vote 25 down vote accepted

There isn't a good answer. But here are your possibilities:



  3. Type in the encryption key when you start up, store it in memory. This protects against offline attacks (unless they capture the key out of RAM, which is tougher to do). Similar to option 1, but also different. However, the server boots into an unusuable state, requiring you to manually supply the key before work can be done.


  5. Store the key elsewhere on the same server. This is a particularly popular option for people who only have one server. Adds marginal security, but not a whole lot. This is what most people do.

  6. Store the key in the database. Now you're hardly even trying. Still, a very popular option.

share|improve this answer
I'm worried this answer might lead someone to think that reversible password encryption is a good idea. This is a correct answer to a misguided question. –  mikerobi Sep 29 at 2:20
Yeah... If memory serves, i barely skimmed the body and instead wrote the answer to the question asked in the title. I should put a disclaimer at the top of my post. –  tylerl Sep 29 at 5:26


share|improve this answer

Your Answer


