How should user passwords be stored?
Options
- Encrypted with AES using a key kept in the app
- Hashed once with SHA-256 and then stored as is
- Hashed with a slow salted function: Argon2id, bcrypt (Correct option)
- Stored in plain text inside a protected database
Answer
Hashed with a slow, salted password hashing function: Argon2id, bcrypt or scrypt
Why
Store passwords so that even if the database is stolen, the attacker cannot get them back.
Encryption is reversible: whoever finds the key gets every password. Fast hashes like SHA-256 can be guessed billions of times per second on GPUs.
Password hashing functions (Argon2id, bcrypt, scrypt) are deliberately slow and add a random salt, making guessing extremely expensive. To log in, hash the attempt and compare.
Remember
Passwords → Argon2id or bcrypt. Never plain, never just SHA-256.