Passwords are the most sensitive thing your app holds. Luckily you do not have to handle them yourself at all — and the alternative is easier too.
The core: storing is never necessary
Your app never needs to keep a password to check whether someone typed the right one. Login systems exist that handle this for you — Supabase, for example, has one built in as standard.
If you create your own table with usernames and passwords, you take on a huge risk for something you can leave to a proven system for free.
Why it goes wrong so often
People reuse passwords. If the passwords from your app leak, attackers will try them on those same people's email, banking and social media. A leak at your small app becomes a leak in your users' entire digital lives.
That is why password tables are the favourite target: one open door yields thousands of keys.
This risk also belongs to cybersecurity for small businesses.
What to do instead
- Use the login system your platform already offers, such as Supabase Auth.
- Prefer passwordless login where possible: an emailed link or signing in via Google.
- Never ask your AI assistant to build 'a custom login'; ask it to use the built-in login system.
- In your own tables, only store data that belongs to your app — never passwords.
Include this check in your checklist for launching safely.
How to recognise it is wrong
If there is a table or field anywhere in your project named 'password' or 'wachtwoord', that is an alarm bell. And if you have ever been able to see a user's password yourself — in an email, a dashboard or a database — then it is stored readably somewhere, which should never happen.
Frequently asked questions
My AI tool built a custom login. Is that bad?
Check where the passwords live. If it uses your platform's built-in system, it is fine. If there is a custom password table, it needs to be rebuilt.
What is login via an emailed link?
Your user receives an email with a link and is logged in immediately. No password to remember — and nothing sensitive for you to store.
Are encrypted passwords okay then?
That is what professional login systems do under the hood, but building that yourself is specialist work full of pitfalls. Use the existing system; it has been tested more thoroughly than anything you build yourself.