I am going through the below link


and in that it says

When SQL Server logins are used, SQL Server login names and encrypted passwords are passed across the network, which makes them less secure.

how are the password encrypted and how does sql server decrypt it? What kind of encryption is involved in it?


2 Answers 2


how are the password encrypted and how does sql server decrypt it? What kind of encryption is involved in it?

Super high level, if you have encryption setup for the instance then the certificate that is configured can be used. If you don't have it enabled, the self-signed certificate created on SQL Server startup will be used.

Regardless of which is used, the SSL/TLS setup for this is done during the pre-login negotation phase. If, however, encryption is either not set or enforced, the TLS/SSL portion will only be active for the length of the credential transfer and will immediately go back to plain text (no SSL/TLS) once this is completed for the life of the connection.

SQL Server itself doesn't encrypt or decrypt the data, it's encrypted and decrypted in transit only. Depending on your client driver and application, this may or may not exist in plain text in your process memory space. Additionally, SQL Server uses hashes to check the passwords and doesn't store the original plain text password for SQL logins (unless you want to be pedantic about proxy accounts and linked servers).


I agree with all the points Sean made in his answer.

However, I think the point the Docs page is trying to make is that Kerberos authentication via Windows never1 passes the password across the network. SQL authentication does, which means there is a chance that someone capturing packets might be able to decrypt that password and login to the SQL Server.

Windows Authentication is based on tokens. When you login to Windows, your Windows account is provided with a unique token by the login authority (LSA or Active Directory) that can be passed around across the network and confirmed by the login authority without the possibility of compromising the account password.

As a result, SQL Server authentication is less secure than Windows Authentication.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.