Editing Challenge-Handshake Authentication Protocol (section)

==Benefits of CHAP==
When the peer sends CHAP, the authentication server will receive it, and obtain the "known good" password from a database, and perform the CHAP calculations.  If the resulting hashes match, then the user is deemed to be authenticated.  If the hashes do not match, then the user's authentication attempt is rejected.

Since the authentication server has to store the password in clear-text, it is impossible to use different [[Password#Form of stored passwords|formats for the stored password]].  If an attacker were to steal the entire database of passwords, all of those passwords would be visible "in the clear" in the database.

As a result, while CHAP can be more secure than PAP when used over a PPP link, it prevents more secure storage "at rest" than with other methods such as [[Password authentication protocol|PAP]].