Encrypting/Decrypting Passwords in ColdFusion

Question

I am currently encrypting user password and storing them in my DB by using the following code:

<cfset encrypted_pass = Hash(#form.pwd#, 'SHA-512')/>

Is there a way I can decrypt this password after the fact?

Answer 1

If you are storing passwords in a database, you should always store these as hashes and not using reversible encryption. The method of doing is this "hashing" but not all hashing is created equal and the "hash" function in CFML is not good enough for password hashing.

The reason for using hashing is so if a "bad actor" gains access to your DB they are still not able to obtain your users passwords.

Please see the following article for details and code examples for good password hashing in CFML:

https://www.andrewdixon.co.uk/2020/05/12/password-hashing-in-cfml/