Websites avoid storing your actual password in a readable format. Instead, they transform it into a scrambled code to keep it safe from hackers.

Password Storage Basics

Hashing is a process that turns any password into a unique string of characters. Like a fingerprint, this code identifies your password without revealing what it actually is.

Digital Fingerprints

Hashing is irreversible, meaning you can turn a password into a hash, but you cannot turn a hash back into a password. This ensures that even if a hacker steals the data, they cannot see your original secret.

The One-Way Street

No matter how long or short your password is, the resulting hash will always be the same length. This makes it impossible for an outsider to guess how many characters are in your original password.

Fixed Length Results

Without extra steps, two users with the same password would have the exact same hash. This allows hackers to guess common passwords by looking for repeating patterns in a database.

The Duplicate Problem

Salting is the act of adding a unique, random string of characters to your password before it is hashed. Think of it like adding a unique spice to a recipe to make the final dish look and taste different every time.

Adding the Salt

Because every user gets a different salt, two people with the same password will have completely different hashes. This prevents hackers from identifying users who share popular or simple passwords.

Creating Unique Hashes

Hackers use 'rainbow tables,' which are giant lists of pre-calculated hashes for common passwords. Salting makes these cheat sheets useless because the random salt changes the final result entirely.

Breaking the Cheat Sheets

When you log in, the system takes your typed password, adds your specific salt, and hashes it. If this new result matches the one saved in the database, the system knows you are the right person.

The Login Match Check

Modern hashing is designed to be slightly slow to perform. This tiny delay doesn't affect you, but it prevents hackers from using supercomputers to guess millions of passwords per second.

Intentional Slowing Down

Security experts use specific formulas like 'Argon2' or 'bcrypt' for hashing. These are trusted because they have been tested by the global community to resist modern hacking techniques.

Choosing Modern Standards

Encryption is like a locked box you can reopen with a key, while hashing is like turning a piece of paper into ash. You can't turn ash back into paper, which is why hashing is better for storing passwords.

Hashing versus Encryption

A 'pepper' is like a salt, but it is kept secret by the company instead of being stored next to your password. This adds a final layer of protection if the main database is ever stolen.

When Fast is Dangerous