thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Fundamentals & Crypto · Intermediate

Password Hashing

Storing passwords as salted, slow, one-way hashes rather than plaintext or reversible encryption.

Definition

Proper password storage uses a unique salt and a deliberately slow algorithm such as Argon2id, scrypt, bcrypt, or PBKDF2 with a high iteration count. Fast general-purpose hashes like unsalted SHA-256 or MD5 are inadequate because GPUs can test billions per second. OWASP's Password Storage Cheat Sheet recommends Argon2id first.

Example

An application stores $argon2id$v=19$m=19456,t=2,p=1$<salt>$<hash> for each user.

Exam tip

Passwords should be hashed, not encrypted, so even administrators cannot recover them.

Related terms