I have written a small password manager script for my own purposes. It is hosted locally and cannot be accessed outside my local network. You can see the code on GutHub
I know it is better to encrypt the passwords before storing them in the database, but how to retrieve them back when viewing the record? I mean I don't need to verify the password but see it's actual value.
There are some options, but they all require a "key" or "salt" that will be hardcoded in the files and can be viewed by anyone. One that I though to use is this:
// Store the cipher method $ciphering = 'AES-128-CTR'; // Use OpenSSl Encryption method $iv_length = openssl_cipher_iv_length($ciphering); $options = 0; # the AES options // Non-NULL Initialization Vector for encryption $encryption_iv = '4828992577348297'; // Store the encryption key $encryption_key = 'tEDo5MHxsqiq6dtXgr7za8EzhXuQqG'; $this->pass_crypted = openssl_encrypt($this->password, $ciphering, $encryption_key, $options, $encryption_iv);
I am thinking of putting
$encryption_key in a file outside the "project" folder and including the file when needed. Are there any other ways?