How to Store Passwords Safely
Why plain text and fast hashes fail, and how salts and bcrypt protect your users
What you'll learn
- Why plain text and encryption aren't enough
- How hashing lets you check a password without storing it
- What salts are and why every user needs one
- Slow hashes like bcrypt and Argon2, and work factors
In this video, we'll look at what an attacker gets when your users table leaks, and how the way you store passwords decides the damage. We'll go from plain text to encryption to hashing, and see why simple unsalted hashes are cracked so quickly.
We'll cover salts, why fast hashes like SHA-256 fall to graphics cards, and how slow hashes like bcrypt and Argon2 make every guess expensive. We'll also see the few lines of code it takes, and how to raise the work factor over time.
By the end, you'll know exactly how to store passwords so a leak doesn't become a disaster.
