How secure is storing passwords online using AES encryption in PHP?

Storing passwords online using AES encryption in PHP can provide an additional layer of security compared to storing plain text passwords. However, it is important to ensure that the encryption key is securely stored and managed to prevent unauthorized access to the passwords. Additionally, implementing proper password hashing techniques in combination with encryption can further enhance the security of stored passwords. 

// Generate a random encryption key
$encryptionKey = openssl_random_pseudo_bytes(32);

// Encrypt the password using AES encryption
function encryptPassword($password, $encryptionKey) {
    $iv = openssl_random_pseudo_bytes(16);
    $encrypted = openssl_encrypt($password, 'AES-256-CBC', $encryptionKey, 0, $iv);
    return base64_encode($iv . $encrypted);
}

// Decrypt the password using AES decryption
function decryptPassword($encryptedPassword, $encryptionKey) {
    $data = base64_decode($encryptedPassword);
    $iv = substr($data, 0, 16);
    $encrypted = substr($data, 16);
    return openssl_decrypt($encrypted, 'AES-256-CBC', $encryptionKey, 0, $iv);
}

// Example usage
$password = 'securepassword123';
$encryptedPassword = encryptPassword($password, $encryptionKey);
echo "Encrypted Password: " . $encryptedPassword . "\n";

$decryptedPassword = decryptPassword($encryptedPassword, $encryptionKey);
echo "Decrypted Password: " . $decryptedPassword . "\n";

Related Questions