title: Encrypting/Hashing plain text passwords in database
body: <p>I've <strong>inherited</strong> a web app that I've just discovered stores over 300,000 usernames/passwords in plain text in a SQL Server database.  I realize that this is a Very Bad Thing™.</p>
  
  <p>Knowing that I'll have to update the login and password update processes to encrypt/decrypt, and with the smallest impact on the rest of the system, what would you recommend as the best way to remove the plain text passwords from the database?</p>
  
  <p>Any help is appreciated.</p>
  
  <p><strong>Edit: Sorry if I was unclear, I meant to ask what would be your procedure to encrypt/hash the passwords, not specific encryption/hashing methods.</strong>  </p>
  
  <p>Should I just:</p>
  
  <ol>
  <li>Make a backup of the DB</li>
  <li>Update login/update password code</li>
  <li>After hours, go through all records in the users table hashing the password and replacing each one</li>
  <li>Test to ensure users can still login/update passwords</li>
  </ol>
  
  <p>I guess my concern is more from the sheer number of users so I want to make sure I'm doing this correctly.</p>