What are some good methods for hashing passwords in an Android app?

I am creating an app that requires the user to register with a remote server, but I want to hash their password before sending it off to be stored in my database.

I tried using the jBCrypt library, but it created a long hang time while h开发者_高级运维ashing. Are there any other alternatives? What would be the best (and safest) way to hash the passwords without creating a noticeable hang?

Your approach seems to be wrong. Unless you have some special requirements, the usual way to do this is the following (not Android-specific, for any web application):

1. When the users register, take their password, hash it (using a random salt is also recommended), and save it in the DB. That is done so you don't save the actual password in your DB.
2. When the user needs to login, you send the actual password to your webapp (use SSL to avoid sending it in the clear), not the hash. On the server, you apply the same hashing algorithm as in step 1, and compare the result to what is in your DB. If they are the same, the user has provided the correct password.

In short, you should do your hashing on the server, not on the Android device.

Avoid saving 3rd party passwords at all cost. Saving them is considered a form of phishing. Try to save an authentication token instead of a raw password that you can get using a method like OAuth.

If you do need to send a password to a database on a webserver, just use HTTPS. This will ensure safe encryption over the wire. Then you can encrypt the password as necessary in the database. This method also ensures that your encryption mechanism is not on the device itself which can be more easily compromised.