Hashing
One-way encryption for passwords and data integrity.
🎯 Learning Objectives
- ▸ Understand the difference between hashing and encryption
- ▸ Learn why hashing is used for passwords
Hashing for Passwords
When a user creates a password, you should not store the password itself. You should store the hash of the password. When they log in, you hash their input and compare it to the stored hash.
Modern hashing algorithms like bcrypt, scrypt, or Argon2 are designed to be slow, making brute-force attacks computationally expensive.
Salt and Pepper
A salt is a random string added to the password before hashing. It ensures that two users with the same password get different hashes. A pepper is a secret key added to the hash, stored separately from the database.
📖 Glossary
- Hash Function
- A mathematical algorithm that maps data of arbitrary size to a bit array of a fixed size.
- Salt
- Random data added to a password before hashing to defend against dictionary attacks.
🔑 Key Takeaways
- Hashing is one-way; encryption is two-way.
- Never store passwords in plain text or encrypted form. Use strong hashing.
- Use salt and pepper to prevent rainbow table attacks.
📚 Further Reading
- OWASP Password Storage Cheat Sheet — OWASP (2023)
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...