I would go with something simple. Quote from Stack Overflow: “Simple answer - No matter what scheme you use it can be cracked. Don’t punish honest customers

I would go with something simple. Quote from Stack Overflow: “Simple answer - No matter what scheme you use it can be cracked. Don’t punish honest customers with a system meant to prevent hackers, as hackers will crack it regardless. A simple hashed code tied to their email or similar is probably good enough.” https://stackoverflow.com/a/599841 https://stackoverflow.com/a/599841