title: My applications need to send emails, where and how should I store the SMTP password?
body: <p>It seems like every application I create needs to be able to send the occasional email. E.g. status emails. For this question, assume my application is a backup tool, locally installed on many windows clients, and each installation needs to send daily status mails. It could be installed on an organization's server or on a private computer.</p>
  
  <p>I am asking the user to provide the credentials to an email account he owns (STMP host, port, username, password, from-address). I copied this approach from applications like Atlassian Jira/Confluence or JFrog Artifactory. Where and how are they storing the SMTP passwords anyway?</p>
  
  <p>My current understanding is: Salting/Hashing approaches do not apply here as I need to be able to retrieve the plaintext password to actually send the emails. I don't want to store the passwords in plaintext, so it's got to be some kind of encryption/decryption approach (right?). </p>
  
  <p>I can tell the user not to use his main email account, but to use some secondary account or, even better, setup a special email account just to be used by my application. If the user is an admin of an organization, he might be able to setup an email account on his exchange server or configure SMTP relaying. But, I know me, and I know my private users, some of them will just use their main email account anyway, so I want to do everything I can to keep their credentials as safe as possible (by that I mean "follow best practices").</p>
  
  <p>Preferrably I would like to store the encrypted password in the application's database.</p>
  
  <p>I've spent hours and hours reading through questions on stackoverflow, but I cannot see a consensus (like there is for user account login credentials). I find this surprising, as I expect basically every developer to be confronted with this problem sooner or later. </p>
  
  <p>There must be some best practices to follow, some established way to go about this, but I haven't found it yet.</p>
  
  <p>Please point me to resources on SO/the web that explain how to tackle this problem. If at all possible written by some specialist in the field.</p>
  
  <p>Some SO questions I have looked at:</p>
  
  <ul>
  <li><a href="https://stackoverflow.com/questions/225838/protecting-user-passwords-in-desktop-applications-rev-2">Protecting user passwords in desktop applications (Rev 2)</a></li>
  <li><a href="https://stackoverflow.com/questions/442923/windows-equivalent-of-os-x-keychain">Windows equivalent of OS X Keychain?</a></li>
  </ul>