True, and actually it is just generally an unsafe practice to pass the password through the pages....hence the practice of most sites assigning a userID number to the userid that the user enters on the site.....

To ensure that somebody has actually logged in, and not by-passed the login page (by typing the directory and .asp page directly) you just have a check at the beginning of each page:

Code:
If session("userid") = "" then
 response.redirect "http:\\mysite.com"
End if

'OR

If request.form("userid") = "" then
 response.redirect "http:\\mysite.com"
End if
I'm probably coming off as saying that the encryption is bad, I'm not at all.....It is quite good and I have used it in applications before....I'm just offering alternatives.