Storing passwords: bcrypt, scrypt and Argon2
How to store passwords safely: why plain text, encryption and fast hashes like SHA-256 all fail, what salts and slow hashing do, how bcrypt, scrypt and Argon2 compare, working code in Python and Java, choosing parameters, and upgrading old hashes.
CodexBash, , 5 min read
Every few months a company announces that its user database was stolen. What happens next depends almost entirely on one decision made years earlier: how the passwords were stored. Stored badly, most of them are recovered within hours and tried on email and bank accounts, because people reuse passwords. Stored well, the attacker gets a pile of values that would take years of computing to crack, even for weak passwords. This article explains what "stored well" means and how to do it in a few lines of code.
Sign in to read the rest
The whole 5 minute article is free with an account, along with every problem, lesson and tutorial. No card.