Encrypting passwords (or hashing them using a cryptographic hash, which would also do what you want) would at least remove the human regularity of the password, reducing the likelihood of the password being acquired by a dictionary attack or other heuristic-enhanced brute force attack.
The trouble with encryption is that if the secret key is ever discovered, then whoever has it can discover the original plaintext of your hashed password(s). With a cryptographic hash, the hash is public and there is no secret key — it is just a one-way function. You could tell the whole world what hash you were using (as long as it is a strong hash), and even if they figured out one of your hashed passwords they would not be able to recover the original plaintext. In practice the difference is probably slight, but since most encryption algorithms use cryptographic hash functions anyway it is simpler and faster to just use a strong hash.
However, here are other password-related problems that this does not solve. You still have the problem that if you ever reuse a (hashed or encrypted) password it can be recovered from one site and used at another, and it does not protect you from phishing attacks. To get a more secure password and solve these problems, check out a free tool called PwdHash that grew out of some research at Stanford.
https://www.pwdhash.com/
PwdHash intercepts web forms and creates a cryptographic hash of your password and the domain to which it is being sent, then sends the resulting hash as your password. This means that (once the tool is set up) if you use the same password for several different sites, those sites actually receive different hashed versions of your password so that stealing a password from one site would be useless for accessing any other sites. It also means that if you enter your information into a phishing site they will not receive your correct password, because by definition the domain to which the information is being sent is different than the legitimate one (even if it looks the same to human eyes), so the result of the hash is different.
PwdHash is not perfect. It will not prevent all possible phishing because it can be fooled by a few client-side tricks, and if you want to log into a web account from a machine that doesn’t have PwdHash installed, you need to use a trusted PwdHash portal to perform the hash for you. However, if you have multiple web logins that use the same password today it is almost certainly a very large improvement in security, especially if some of the sites are more secure than others.
Dr. Wilson
tjwoods changed the tags on this post: they were "" 8 months ago.