We saved the encrypted version to enable password reset. When you reset your password we send an activation code to the email you signed up with (We don’t save that email ). To reset your password you need to enter that email. We encrypt the value on the client and compare it we the value we have on our server. To make sure it s really you But at any time we don’t have user emails stored on our system. So If someone gets access she will never see emails in clear text. And most importantly we will never send users marketing emails. Only registration and password reset emails. We want to know as little as possible about our users.