When storing hashed passwords, then whitespace removal is a non-issue:
- You never store the passwords themselves, but the output of a hash function instead.
- This hash function produces fixed-size output (or you are likely using a reversible encryption algorithm).
- The output of most hash functions is already fixed-sized plaintext that doesn't include any spaces. Otherwise, you are probably using a hash function not intended for password hashing.
- The fixed-sized salt is stored along with the hash output (Password hashing functions which are aware of salting usually output the salt with the hashed password).
- If you want to be flexible and be able to upgrade to a better hash function in the future, you also have to remember which hash function was used. It is recommendable to use plaintext for this information, which makes the complete record variable-length. RFC 2307 describes such a possible plaintext storage scheme.
Passwords should be hashed with a modern and proven key-stretching algorithm, but not with cryptographic hash functions like SHA-256 or MD5. Suitable algorithms include PBKDF2, bcrypt, or scrypt.
For example, hashing the string "pass phrase" with bcrypt and a new salt may produce
algorithm random salt password hash
The whole string can be used as salt, as the actual password hash will be cut off and not be used as salt.
Recommended workflow for validating a login attempt:
- The user provides an username and password. Be careful to handle Unicode normalization and encodings.
- The hashed password is fetched from the DB based on the username.
- The hashed password is parsed to determine the algorithm used.
- The correct algorithm is invoked with the user password as input with the hashed password as salt.
- If the two hashes match, then a correct password was provided by the user.
Recommended workflow for setting a new password:
- If the user already exists, authenticate him.
- Obtain a new password from the user. Take care to handle Unicode normalization and encodings. Give the user feedback on the strength of his password (but do not frustrate the user with silly requirements like forbidden characters or restrictive maximal lengths).
- Create a new salt, which must not depend on user input like the password or user names.
- Pick a strong password hashing function and hash the password with the new salt.
- Update the DB to store the new password along with an identifier for the hash function.
- Encrypted data is binary data, and should not be stored as text (use a blob instead).
- Hashes are usually often represented as plaintext and not as binary data because text is easier to store.
- In many scenarios you can use OpenID instead of implementing your own authentication. E.g. Stack Exchange offers login with OpenID. Because I use this option, I never had to disclose a password to SE.
- I have no cryptographic background. Information Security is frequented
by people who understand more of the matter.
 Here, “plaintext” means printable ASCII characters. It does not refer to the clear text of a password.