title: Using Crypto-JS (SHA256) To Client Hash A Password
body: <p>I'm in the process of making a (relatively) insecure login page for my local LAN webserver, however, I don't want any passwords to be stored in plain text.</p>
  
  <p>Code Is Below:</p>
  
  <pre><code>function validate(){
  var username = document.getElementById("username").value;
  var password = document.getElementById("password").value;
  var encrypted_password = CryptoJS.SHA256(password)
  String(encrypted_password)
  if ( username == "Username" &amp;&amp; encrypted_password == "89e01536ac207279409d4de1e5253e01f4a1769e696db0d6062ca9b8f56767c8"){
      window.location = "dashboard/"
      return false;
  }
  else{
      alert("Your username or password was entered incorrectly.")
      return false;
  }
  </code></pre>
  
  <p>}</p>
  
  <p>For the purpose of demonstration, the correct username is "Username," and the hashed password is "mypassword".</p>
  
  <p>What I want the Javascript to do:</p>
  
  <ol>
  <li>Store the input of <strong>username</strong> and <strong>password</strong> in variables <strong>username</strong> and <strong>password</strong> respectively.</li>
  <li>Store the hashed version of <strong>password</strong> in <strong>encrypted_password</strong></li>
  <li>Compare the <strong>username</strong> and <strong>encrypted_password</strong> variables to the correct answers, and if correct, forward the user on to dashboard/</li>
  </ol>
  
  <p>However, even when "mypassword" is entered, and the hash is the same as that of the correct login code, it alerts me that the password was entered wrong. I think that this is an error in the way that I have stored the <strong>encrypted_password</strong> variable, however, I am not too sure.</p>
  
  <p><em>I should add (after some security conscious people commented on the faults of this design) that this project is for experimentation, and is a project for myself to learn more about the flaws of some cryptography solutions. Had this been a real production website, the flaws in its security would be quite obvious, I would imagine. Thanks again.</em></p>