Why Never Store Passwords in Plaintext – Java Security

Direct Answer

Passwords must not be stored in plaintext because anyone who reads the user table, backup, log, or support export immediately learns every password. Store a salted password hash produced by a password-specific function such as Argon2id; the application verifies a login by running the candidate through the same function. A leaked hash can still be guessed offline, so strong work settings, unique salts, rate limits, MFA, and breach response are still needed.

Code Example

@Service
class RegistrationService {
    private final UserRepository users;
    private final PasswordEncoder passwordEncoder;

    void register(String email, char[] rawPassword) {
        String verifier = passwordEncoder.encode(CharBuffer.wrap(rawPassword));
        users.save(new User(email, verifier));
        Arrays.fill(rawPassword, '\0');
    }

    boolean passwordMatches(User user, CharSequence candidate) {
        return passwordEncoder.matches(candidate, user.passwordHash());
    }
}

Store only the encoded verifier. Never log either the password or its candidate value, and do not compare a newly encoded value with equals because modern encoders generate a fresh salt.

Common Mistakes & Pitfalls

• Using encryption instead of hashing: Freshers often think AES-encrypting passwords is secure, but encryption requires storing a decryption key somewhere—in config files, environment variables, or key vaults. If an attacker compromises the application, they get both encrypted passwords and the key to decrypt them. Hashing is one-way by design.
• Logging passwords during debugging: Adding log.info("User password: " + password) during development seems harmless, but logs persist in Splunk, CloudWatch, or text files for months. One careless debug statement leaks credentials to everyone with log access.
• Storing passwords in JWT tokens or session data: Putting the raw password in a JWT claim or Redis session cache defeats the entire purpose of hashing—these storage mechanisms are less protected than your primary database.