https://nalar.dev/tags/password-hashing/ Recent content in Password Hashing on Nalar Hugo en-us Thu, 03 Sep 2026 00:00:00 +0700 https://nalar.dev/store-passwords-with-memory-hard-hashing/ Thu, 03 Sep 2026 00:00:00 +0700 https://nalar.dev/store-passwords-with-memory-hard-hashing/ <p>A login system must verify passwords, but it should not need to recover them. That distinction matters when an authentication database is copied through a vulnerability, backup exposure, or operational mistake.</p> <p>If the database contains plaintext passwords, the compromise immediately reveals them. If it contains fast, unsalted hashes, an attacker can test large numbers of password guesses efficiently and reuse work across accounts.</p> <p>Password hashing changes the problem. The application stores a <strong>verifier</strong> produced by a deliberately expensive password-hashing function. During login, it applies the same function to the submitted password and checks whether the result matches.</p>