Storing password encrypted or a function of the original password (hashed) is all wrong and the entire premise of the post follows suit. After a successful aut

Storing password encrypted or a function of the original password (hashed) is all wrong and the entire premise of the post follows suit. After a successful authentication with username/password - store a one time token (randomly generated) on the client. Each time the token is used - generate a new one. That's it. On the server store a hash of that token, so getting the database of tokens does nothing, either. The user retains ability to revoke any tokens at any time and also to know where they have been stored and used (if they choose to name a device/storage)