Passwords

Password storage is about keeping users’ passwords in a form that’s useless to an attacker who steals your database. You never store the password itself; you store a hash, a one-way scramble, and at login you hash what the user typed and compare. Each password gets a random salt mixed in first, so identical passwords produce different hashes and precomputed lookup tables don’t work. The crucial choice is the hash function: general-purpose hashes like SHA-256 are designed to be fast, letting a GPU test billions of guesses per second, so password hashes like bcrypt, scrypt and Argon2 are deliberately slow, and some also memory-hungry, making each guess expensive for the attacker while one login stays quick.