Hashing, salting, and slow hashes
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
explain why passwords are hashed, salted, and hashed slowly.
Planned topics
- Encryption can be reversed with a key. Hashing is one-way; you store the hash, never the password.
- To log in, hash the attempt and compare.
- A salt is random data added per user, so equal passwords get different hashes and precomputed tables fail.
- Fast hashes (MD5, SHA-256) let attackers try billions of guesses per second. Password hashes are deliberately slow and costly: bcrypt, scrypt, Argon2.
- The slowness is tunable (cost factor) and can be raised over time.
Draft outline details
Demonstration
bcrypt("secret") twice gives two different strings, both starting $2a$ or $2b$ with the cost embedded.
Check your understanding
Why is SHA-256 a poor choice for passwords?
Show answer
It is too fast, so guessing is cheap.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.