Tag Info

New answers tagged


Server shouldn't know plain password If the user types their password into a web page in a browser, the server that hosts that web page always has the opportunity to see what password was entered. There's no cryptographic mechanism that can prevent that (at this point in time). To get around this limitation, you need to build a downloadable ...


Actually you are quite near on implementing PBKDF2. It is kind of iterated HMAC execution. So have a look here and just implement the missing parts: PBKDF2

Top 50 recent answers are included