Sending password safely from the front-end to the back-end using MD5

Question

I've encrypted a password field in my DB by MD5, and I handle it encrypted in my back-end, but when user types their password in, it is in plain text.

Is there a safe way to pass the password from the front-end to the back-end? MD5 doesn´t have sense in this case...

NOTE: I'm using HTTPS and the POST Method.

Answer 1

You can think about the following steps to protect the password:

1. Use HTTPS preferably with HSTS to protect the passwords during transport;

2. Use a password hash such as bcrypt instead of MD5 to protect the password on the server.

   • HASH passwords with salt;
   • use a high work factor for bcrypt.

MD5 is not the best way to hash. MD5 is not considered secure anymore.

MD5 is not encryption; don't encrypt passwords, hash them, encryption can be decrypted, hashing cannot be reversed.