My webhost doesn't allow SSL certificates for my webhosting product since it is a shared IP server. (I would have to upgrade the product and pay a lot more money, which I don't want to at the moment) I don't really need all of the website encrypted, I only want to give the password (and username) submission on login a bit more protection. Is there a module that just does some asymmetric encryption on the password on submission, e.g. with JavaScript?

Note: I know about the possibility of Man-in-the-Middle attacks with this setup.

  • Also relevant: security.stackexchange.com/questions/23006/…
    – Felix Eve
    Feb 14, 2014 at 15:52
  • @FelixEve, fair point...
    – Turion
    Feb 14, 2014 at 15:53
  • @Turion I think this is a pretty straight-up dupe of the question so I've closed it...if you disagree please let me know and I'll open this one back up again
    – Clive
    Feb 14, 2014 at 15:54
  • @Clive, I don't think it should be closed. The functionality is similar, yes, but the user experience should be a different one - the answer to the other question recommends installing additional software or using SSL, both impossible for me. Also, the security implications of my questions are much more serious than those in the other question and would need to be addressed.
    – Turion
    Feb 14, 2014 at 15:59
  • Fair dos, I've re-opened it. I wish you the best getting an answer, but I highly doubt you'll get one that satisfies all of your conditions. There's a very good reason people stay as far as possible away from client-side encryption on the web - it ain't secure
    – Clive
    Feb 14, 2014 at 16:04

1 Answer 1


So far, the only way that I've found to encrypt user login without SSL is the Encrypt Submissions Module (https://www.drupal.org/project/encrypt_submissions)

It uses the jCryption library (http://www.jcryption.org/) to encrypt the username and password that drupal offers up in clear text otherwise. Fairly straightforward to set up. The only server requirement is bcmath php module which most servers have anyway.

I use Encrypt Submissions whenever I can't use SSL, not as a replacement. You may want to consider switching hosts if they don't allow SSL certs, they sound pretty backwards.

  • But its doesn't work well, login form is reloaded its shows in console the encryption key but its doesn't redirect to user's dashboard
    – user67248
    Feb 23, 2017 at 5:05
  • please provide help to get out rid the errors of this module
    – user67248
    Feb 23, 2017 at 6:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.