Passwords shouldn't be encrypted anyway. Chances are hackers will be able to obtain the key too, and then passwords are really easy to fetch. Passwords should

Passwords shouldn't be encrypted anyway. Chances are hackers will be able to obtain the key too, and then passwords are really easy to fetch. Passwords should be hashed non-reversible (ideally using a slow hash). The original password is to no use of the application. And sending plain-text passwords to users is even more bad[1]. [1]: http://plaintextoffenders.com/ http://plaintextoffenders.com/