Abstract: The invention relates to a system and method for enhancing the security of information by decoupling the user authentication from the data storage and access. User information, stored by a service provider, is encrypted using a hashed password and access to the encrypted user information is protected by a separate access control server. The access control server and service provider may be provided a uniquely hashed first and second password, respectively. The access control server uses the first hashed password to allow the user access to the service provider, and the service provider then decrypts the user information using the second hashed password. The system ensures that even if the malicious user manages to compromise either the service provider or the access control server the malicious user would remain unable to decrypt and access any stored user information.