Password hashing

How a website checks your password without ever storing it

A well-built site doesn't keep your password. It keeps a hash of it: the one-way fingerprint from lesson 1. When you log in, it hashes what you typed and checks that the two fingerprints match.

Two extras make this safe. A salt is a random string made fresh for each user and stored next to their hash. And the hash is slow on purpose (bcrypt, scrypt or Argon2), so every guess costs time and memory.

Why not encrypt the passwords instead? Encryption is undone with a key, and a thief who takes the database often gets the key too. A hash has no key that undoes it, so the thief can only guess passwords and hash each guess.

Password hashing

Why 'Forgot password' sends a reset link, not your old password

When you click 'Forgot password' on a well-run site, you get a link to set a new password. The site can't email your old one because it never kept it, only a salted hash.

LinkedIn shows what happens otherwise. In 2012 its leaked passwords turned out to be unsalted SHA-1, a fast general-purpose hash, and most were cracked. Today OWASP recommends Argon2id, the winner of the 2015 Password Hashing Competition.

Password hashing

Each password gets its own random salt and a deliberately slow hash

A salt for each user forces the attacker to redo every guess for every user. Without salt, 'sunshine1' always gives the same hash, so a rainbow table (a ready-made list of common passwords and their hashes) cracks everyone who used it.

Slowness does the rest. A graphics card (GPU) can try billions of SHA-256 hashes a second, but Argon2 can be tuned to take about 0.1 s and 64 MB per hash. You won't notice that at login, but it makes a cracker millions of times slower.

The memory matters because GPUs and custom chips have thousands of cores but little memory per core. That means they can't run many memory-hungry guesses side by side.