🔐Password Hashing

NEW

Securing stored passwords by applying salted, one-way, adaptive hash functions to resist offline and brute-force attacks.

DESCRIPTION

Password hashing transforms a password using a cryptographic one-way function, combined with a unique salt and sufficient work factor to prevent efficient reversal. Algorithms like Argon2, bcrypt, scrypt, and PBKDF2 incorporate tunable cost parameters to slow guessing. Proper storage includes per-user salts, optional pepper, and secure credential lifecycle management. Hashing contrasts with reversible encryption, which must not be used for password storage. Compliance frameworks mandate salted hashing and breach-resistant practices.

ALTERNATIVE DEFINITIONS

OWASP Cheat Sheet Series

Passwords must be hashed using a strong adaptive and salted hashing algorithm such as Argon2, bcrypt, or PBKDF2.

Explicitly recommends adaptive, salted algorithms and lists commonly accepted choices.

Source

NIST SP 800-63B

Memorized secrets SHALL be salted and hashed using an approved one-way key derivation function.

Provides normative, regulatory-grade guidance for credential storage.

Source

CrackStation

Password hashing is the process of taking a password and applying a one-way function to it.

Focuses on the irreversibility property and basic concept.

Source

RELATED TERMS

Salt Pepper Key Stretching Password-Based Key Derivation Function 2 bcrypt scrypt Argon2 HMAC Credential Storage

COMPETING TERMS

Passwordless Authentication Symmetric Encryption

RELATIONS

• Broader: Hashing
• Narrower: Argon2

KNOWLEDGE AREAS

Data Security Data Privacy & Compliance Software Engineering

TARGET AUDIENCE

Security Architect Cybersecurity Engineer Software Developer DevOps Engineer Data Privacy Officer IT Auditor IT Manager

EXTERNAL SOURCES

• Wikipedia - Password hash
• OWASP - Best practices for password storage
• NIST - Digital identity guidelines
• IETF - PKCS #5 v2.1 specification for PBKDF2
• Password Hashing Competition - Argon2 specification and rationale

TOP QUESTIONS

Why is Password Hashing necessary?

It protects stored credentials by making stolen hashes hard to reverse. Salting and high work factors resist offline cracking.

Category: Relevancy

What algorithms are recommended for Password Hashing?

Argon2, bcrypt, scrypt, and PBKDF2 are widely recommended adaptive functions with tunable cost parameters.

Category: BestPractices

What is a salt in Password Hashing?

A unique random value per password that prevents precomputed attacks and cross-user hash collisions.

Category: Definition

What common mistakes occur with Password Hashing?

Using fast hashes (e.g., SHA-256 alone), omitting salts, and weak iteration counts are frequent errors.

Category: Mistakes

What are the risks of improper Password Hashing?

Rapid credential compromise after a breach, user impersonation, and regulatory penalties for inadequate protection.

Category: Risks

How to choose cost parameters for Password Hashing?

Benchmark on production hardware; target acceptable login latency while maximizing resistance to attackers.

Category: HowTo

Is Password Hashing the same as encryption?

No. Hashing is one-way; encryption is reversible with a key. Do not store passwords with reversible encryption.

Category: Misunderstanding

How does Passwordless Authentication relate to Password Hashing?

Passwordless reduces reliance on stored secrets, but hashed credentials remain relevant where passwords persist.

Category: Comparison

Where to learn Password Hashing best practices?

Start with OWASP cheat sheets, NIST SP 800-63B, and algorithm specifications like Argon2 and RFC 8018.

Category: Learning