Also known as: bcrypt · Argon2 · scrypt · password storage
Password hashing is the practice of storing passwords as the output of a deliberately slow, salted one-way function, so that a breach of the credential database does not immediately yield usable plaintext passwords.
The defining requirement is that the function be slow and memory-hard, which is why general-purpose hashes like SHA-256 are unsuitable despite being cryptographically sound — they are designed to be fast, which is precisely what an attacker cracking billions of candidates wants.
Argon2id is the current recommended default, with bcrypt and scrypt remaining acceptable. Salting — a unique random value per password — prevents precomputed rainbow table attacks and ensures identical passwords do not produce identical hashes.
Credential Stuffing
Credential stuffing is an automated attack that takes username and password pairs leaked from one breach and tries them en masse against other services, exploiting the fact that many people reuse the same password across sites.
Encryption at Rest
Encryption at rest is the encryption of stored data — on disks, in databases, or in backups — so that physical access to the storage medium does not yield readable data.
Multi-Factor Authentication
Multi-factor authentication (MFA) requires two or more independent categories of evidence to verify identity — typically something you know, something you have, and something you are — so that a stolen password alone is insufficient to gain access.
End-to-End Encryption
End-to-end encryption (E2EE) is a system in which messages are encrypted on the sender's device and decrypted only on the recipient's, so that no intermediary — including the service provider — can read the content in transit or at rest on its servers.