Is it safe to store verification codes in a database?

Question

Information Security

A system is needed in which actions such as registration, password reset, etc., are carried out thanks to six-digit digital codes that the user receives via SMS and e-mail.

I made a model in which the code itself is stored, the date when it will be expired and the user to whom this code is attached. The code is generated randomly, and accordingly it cannot be guaranteed to be unique, so a user is required.

Does the code need to be encrypted? Is it normal that it can be read in its pure form in the database?
Indeed, if the database is hacked, then even considering that all passwords are encrypted, there may be active password reset codes that can be used.

I have seen many solutions in which the code is kept in its pure form, and this moment confuses me.

Answer 1

Indeed, if the database is hacked, then even considering that all passwords are encrypted, there may be active password reset codes that can be used.

It's strange, taking off your head, crying through your hair. If your database has already been hacked, you can simply change the password for the user (and indeed, there is access to all data anyway).
Unless you're imagining some sort of half-ass hack... Well, then you can encrypt it with a password stored somewhere in the app's settings.

Answer 2

Considering the cracker's scenario will help answer your question.
Here he will get access to the database. What can he do with a one-time code? Maybe he won't need it at all, if he can get or prescribe a session of the desired user.
Are you not embarrassed by the use of an insecure SMS channel? Since you are already using it, it means that this data is not of great value. However, this is not credit card information.
If you do get hacked, cancel all sessions and codes, demand that all user passwords be replaced (if you use them at all).