system
Given the following post, respond as if you're commenting on Reddit:
human
How are the passwords for encrypted information kept secure?

I'm not well versed in cryptology so bear me while I try to explain my question. I'm curious where exactly the password that is used to unlock encrypted information is stored, so as to be secure. If its at some memory address, wouldn't it be possible to monitor the apps activity to see what memory addresses are checked? If its part of the encrypted information wouldn't it be possible to essentially reverse engineer the apps protocol to view the password?

Sorry if the question is unclear, I'll try and explain it more if need be in the comments.
gpt
Assuming the programmers are competent, it *isn't* stored. The password is the "key" that is used to encrypt and decrypt the data. The program uses the password to encrypt the data, and then *throws it away*. It doesn't remember it for any longer than it absolutely has to. At this point, you have an encrypted data file and absolutely no password anywhere on the system; the program couldn't decrypt it by itself even if it wanted to.

To decrypt it later, the program asks you for a password. Since it doesn't know what the right password is, at this point it has no idea whether you entered the right password or not! All it does is use that password to decrypt the data. If you entered the right password, the file will be correctly decrypted and now "make sense" to the program. If you entered the wrong password, the "decrypted" file will be random nonsense instead of a correctly-decrypted file. So if the resulting data is valid, the program knows you entered the correct password, and you can now interact with the file.

Storing passwords elsewhere, like on a web site, works a bit differently. Generally speaking, there's going to be a database table somewhere containing user information. Bad programmers (these people should never be allowed near networking code!) will just store the password directly in the database, in plain text, so that it can be compared to the password the user entered. Don't ever, ever, ever do that, because then if someone gets access to your machine, they have everybody's password. Unfortunately, even big companies who should know better have been known to do this.

Better programmers will instead store a *hash* of the password in the database. A hash is a number computed from the password (usually also with another number known as the "salt"), in such a way that it is relatively easy to compute the hash from the password, but more-or-less impossible to compute the password from the hash. It's a lot like encryption in that respect: easy to do forwards, really hard to do backwards. This means that if someone hacks into your system and steals the database, they have the hashes of everybody's password, but still can't log on because they don't know what password was used to generate that hash. The client sends the password to the server (hopefully encrypted!), the server computes the hash from the password, and if the hash computed from the password matches the hash in the database, the password is assumed to be correct.

Even better programmers won't send the password to the server in the first place, instead proving to the server that the client knows the password without actually sending it to the server. One simple way to do this is to have the server send the client a "challenge", which is a big random number generated in a secure fashion. The client generates a hash from this number and the hash of the password  -- essentially encrypting the challenge and the password together. The server (which knows the password's hash, but not the password itself) can perform the same operation, so it knows the answer the client is supposed to send it and can check that the answer is right. So the server knows that the client knows the right password, even though it doesn't (and *never did*) itself know what the password is!