maybe encrypt the password better... the base64 used now is to easy to get out of a cookie(it's quite easy to use thou ). try a different encrytpion type like mcrypt. it uses a string wich to crypt with that you can choose for yourself, and no-one will see.