# About password encryption **URL:** \ **Category:** Flowable Application\ **Created:** [May 9, 2017, 1:34pm UTC](https://forum.flowable.org/t/about-password-encryption/544 "2017-05-09T13:34:59Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![man](https://avatars.discourse-cdn.com/v4/letter/m/f17d59/32.png) [@man](https://forum.flowable.org/u/man)\ **Post date:** [May 9, 2017, 1:34pm UTC](https://forum.flowable.org/t/about-password-encryption/544/1 "2017-05-09T13:34:59Z")
I need password encryption in the database. about act\_id\_user PWD\_ . I need you to tell me what to do 。 thanks! ---
**Author:** ![tijs](https://avatars.discourse-cdn.com/v4/letter/t/bc79bd/32.png) [@tijs](https://forum.flowable.org/u/tijs)\ **Post date:** [May 10, 2017, 10:11am UTC](https://forum.flowable.org/t/about-password-encryption/544/2 "2017-05-10T10:11:15Z")
Hi, The identity tables in Flowable are just a simple implementation, but I agree that the plain text passwords are not great. There’s already an open issue for this and we need to implement the hashing logic for this. Best regards, Tijs ---
**Author:** ![man](https://avatars.discourse-cdn.com/v4/letter/m/f17d59/32.png) [@man](https://forum.flowable.org/u/man)\ **Post date:** [May 10, 2017, 2:09pm UTC](https://forum.flowable.org/t/about-password-encryption/544/3 "2017-05-10T14:09:30Z")
Is this implementation already in the plan? It looks nice. ---
**Author:** ![Sibok666](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/sibok666/32/292_2.png) [@Sibok666](https://forum.flowable.org/u/Sibok666)\ **Post date:** [May 10, 2017, 3:01pm UTC](https://forum.flowable.org/t/about-password-encryption/544/4 "2017-05-10T15:01:04Z")
Wich kind of encryption do you plan to use an MD5 hash? Maybe I could help to develop this feature. Ill wait for yoyr comments. Best regards ---
**Author:** ![tijs](https://avatars.discourse-cdn.com/v4/letter/t/bc79bd/32.png) [@tijs](https://forum.flowable.org/u/tijs)\ **Post date:** [May 10, 2017, 3:34pm UTC](https://forum.flowable.org/t/about-password-encryption/544/5 "2017-05-10T15:34:49Z")
A MD5 hash would be fine indeed. If you can help with the implementation, that’s great. Best regards, Tijs ---
**Author:** ![pstapleton](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/pstapleton/32/678_2.png) [@pstapleton](https://forum.flowable.org/u/pstapleton)\ **Post date:** [May 11, 2017, 7:26am UTC](https://forum.flowable.org/t/about-password-encryption/544/6 "2017-05-11T07:26:23Z")
Hi, I suggest that when this is implemented it should not be a MD5 hash. This is not a recommended way to do this anymore. It is more usual to use an algorithm suited to hashing passwords like bcrypt, scrypt or PBKDF2 with a salt which is also saved in the database. This is then hard to bruteforce if the database is compromised. I Think if this is implemented it should be done in a way that is considered good by todays standards. References: [https://crackstation.net/hashing-security.htm#faq](https://crackstation.net/hashing-security.htm#faq) [https://www.owasp.org/index.php/Hashing\_Java](https://www.owasp.org/index.php/Hashing_Java) [http://security.blogoverflow.com/2013/09/about-secure-password-hashing/](http://security.blogoverflow.com/2013/09/about-secure-password-hashing/) /Paul ---
**Author:** ![aeilers](https://avatars.discourse-cdn.com/v4/letter/a/b9e5f3/32.png) [@aeilers](https://forum.flowable.org/u/aeilers)\ **Post date:** [May 19, 2017, 10:43am UTC](https://forum.flowable.org/t/about-password-encryption/544/7 "2017-05-19T10:43:15Z")
> I suggest that when this is implemented it should not be a MD5 hash. This is not a recommended way to do this anymore. I can second this. MD5 is not secure anymore. Is there already an issue for this topic? ---
**Author:** ![tijs](https://avatars.discourse-cdn.com/v4/letter/t/bc79bd/32.png) [@tijs](https://forum.flowable.org/u/tijs)\ **Post date:** [May 19, 2017, 3:32pm UTC](https://forum.flowable.org/t/about-password-encryption/544/8 "2017-05-19T15:32:10Z")
Yes this issue is already created: [https://github.com/flowable/flowable-engine/issues/354](https://github.com/flowable/flowable-engine/issues/354) Best regards, Tijs ---
**Author:** ![faizal](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/faizal/32/213_2.png) [@faizal](https://forum.flowable.org/u/faizal)\ **Post date:** [June 11, 2017, 8:27am UTC](https://forum.flowable.org/t/about-password-encryption/544/9 "2017-06-11T08:27:36Z")
Currently I’m working on this issue. Instead of implement password hashing, I decided to reuse existing library. So far I’ve added support for Spring Security, Apache Common Codec, Jasypt and jBrypt Let me know if I miss out any other library