Lesson 3.2
Password storage and hashing
Passwords are hashed with a slow, salted algorithm designed for the job. Anything faster is a favour to whoever steals the table.
10mIntermediate8,471 students
Sign in to watch this lesson
Browsing is free. Create an account to play videos and track your progress.
Overview
Passwords are hashed with a slow, salted algorithm designed for the job. Anything faster is a favour to whoever steals the table.
What this lesson covers
- Use a slow, salted hash such as argon2 or bcrypt
- Tune work factors as hardware improves
- Handle reset flows without leaking account existence
This lesson sits in Authentication Done Right, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.
In this lesson you will:
- Use a slow, salted hash such as argon2 or bcrypt
- Tune work factors as hardware improves
- Handle reset flows without leaking account existence
Pro Tip
Never write your own password hashing. Use a vetted algorithm with sane parameters and move on.