How should passwords be stored?
Passwords should never be stored as plaintext. They should be processed using a password-specific hashing algorithm such as Argon2, bcrypt, or scrypt, with appropriate parameters. Password hashing should be deliberately expensive and should use salts so identical passwords do not result in identical stored hashes.
Key Takeaways
- Never store plaintext passwords.
- Use password-specific hashing algorithms.
- Salts help prevent identical passwords from producing identical hashes.
Knowledge Check
How should user passwords normally be stored?