security - Remote password when online, and Local password when offline -

so have app i'd user able use when offline. there password when online, , i'd use same password when user offline.

it's not super privacy sensitive app, i'd still rather not store entire hashed salted password locally on disk. i'm thinking, i'll hash password , store on disk first 4 digits of resulting hash or something. way, user still entering same password online or offline.

is idea or horribly misguided?

in general feature bad idea. attacker doesn't need sql injection compromise password hash.

if store first 4 digits of resulting hash, create possibility of large number of possible passwords. 4 digits of base 16 16^4 or 65536 passwords, or put way take no more 65536 guesses obtain correct password... horribly insecure.

encrypted file systems have similar problem. have able verify password, , want prevent offline brute force. employ key stretching, using bcrypt, scrypt or pbkdf2 expend fair amount ram , cpu in order verify password correct. bcrypt few thousand rounds should sufficient prevent offline attacks.