Is it safe to store user's secure pass-code in database with encrypted form while creating bitcoin wallet?

Question

I would like to create a Bitcoin Wallet.

Part of the process is to store public and private keys in encrypted form in server database.

All keys I am storing is encrypted using user's passcode.

1) Is it safe to store user's passcode in encrypted form in server database. (Thinking that User might forget his passcode so considering one recovery option)

2) Is there any kind of future possibility that I get in trouble if any kind of attack happens or by action of some intruder/admin itself(worst possibility) - the key reveal to the attacker which will lead access and open up all the pub/priv keys from database of that specific User? This way I can not give forget pass-code option to user.

So considering both option Shall I store User's pass-code or not?

What is the best practice to implement this security feature in bitcoin wallet ?

Answer 1

Best practise is to only store a hash of a password, not the password itself. You should also include a random salt before hashing. You should be aware of which well-known hashing algorithms are no longer considered safe for this use.

Encrypting the password before storing it is not a good strategy because you end up with one encryption key, stored somewhere as plain-text, that can unlock all user's passwords. This is a gift to hackers.

You need to take care of how you hold the password in memory for use when encrypting and decrypting other data (keys etc). For example, you need to be sure other processes and plugins can't see into your processes' memory space and that before being released, any allocated memory is cleared. This should be automatic with most modern systems but it is your responsibility to be certain of this.

Yes, amateur attempting to write security code is probably a good way to destroy your business, destroy your reputation and put yourself in the way of civil or criminal proceedings for negligence.

To be honest this question might be better asked on somewhere like Security.stackexchange. There's nothing Bitcoin-specific about this.