LESSON 3.2
Password storage and hashing
Learn key techniques and workflows in Practical Web Security.
10m
intermediate
8,471 students
Overview
Passwords are hashed with a slow, salted algorithm designed for the job. Anything faster is a favour to whoever steals the table.
In this lesson you will:
- Use a slow, salted hash such as argon2 or bcrypt
- Tune work factors as hardware improves
- Handle reset flows without leaking account existence
Pro Tip
Never write your own password hashing. Use a vetted algorithm with sane parameters and move on.