[ArkPhaze]

@Deque Yes you are pretty much correct, I got myself confused between and Encryption and Encoding. Well that makes sense as the passwords are not secure at all. Can you explain what you suggested a little bit more (The master password part)

Let's take as example how Firefox stores login data.
It saves these logins encrypted with 3DES. But it needs a key for doing so. A hardcoded key is not secure at all, but is the only solution if the user doesn't give a masterpassword.
If the user sets a masterpassword, this password is used to generate the key for 3DES encryption and decryption.
You don't have to save the password. The program recognizes that you have given the correct password by a known passphrase in the file.

I.e. imagine you have a passwordfile as txt that looks like this:

Code:

mysimplepassphrase user:pass user:pass user:pass ...

Now you encrypt the whole file, including the passphrase.
Some time later when the user wants access to the passwords, he has to give you the masterpassword, that you used for encryption.
You also use the given password for decryption. If it was the right one, the passphase mysimplepassphase is readable again. You do something like (Pseudocode):

Code:

decryptedtext = decrypt(file) firstline = decryptedtext.readLine() if(firstline == "mysimplepassphrase") { correctpass } else { wrongpass }

If I'm understanding this correctly, "mysimplepassphrase" is used for both the encryption and decryption as the key, but for decryption, it checks against the hardcoded plaintext of the master password anyways to see if you have entered the master password as input, itself? :lol:

I would save that checking value as an SHA256 hash or something, then on decryption, check if $sha256_hash(value) is == the hardcoded value if you're going to hardcode anything.

Even better to include some kind of salt on top to add a bit of "zest". (Bake for 20 minutes, and then let stand for 5. lol)