JWT – Why is the Payload Public in JSON Web Token?

How about just not storing the password at all, not even in local storage? You can use a key derivation function to get a key from the password. With a salt and a reasonable number of iterations this should be decently secure.

Some people and most companies have a strange perception about the value of code.

"We spent $100,000 on this project therefore the code must be worth that" and feel a need to protect it.

In reality most code is more like paint. You spend $100 on paint and $200 dollars to apply it to your walls. But now the paint is worth nothing, you cannot sell it, nobody wants it, and even if they did you cannot take it of your wall and put it on somebody else's wall.

It may enhance the value of the building but you cannot realize this without selling the building.

You could "steal" Amazons code base (most of it is freely available from various open source projects) and set up an Ammassons web site but you would not take over much of Amazons business.

Code is a necessary part of any modern businesses infrastructure, but, it only has value as part of a process and culture, on its own its worth nothing.

I would add there are some situations where the code is vital to the business and would be valuable enough to any competitor that it should be kept secret:

• To prevent malicious manipulation of your facilities -- a good example would be Google's "page rank" system which is constantly being "gamed" to give web sites an unjustifiably high rank.
• Automated Trading Algorithms -- an unscrupulous competitor could study the algorithm and fool your system into selling too low and buying too high.
• A "faster/better" algorithim -- if your software' s unique selling point is a faster better algorithm for sorting/compressing/whatever then it probably pays to keep this a trade secret for as long as possible.