Lion Cipher Lab
How passwords are really stored: hashing, salting, and slow hashes
- Identity & Access Management
- Beginner
- ~25 min
- Free · no account required
Why it matters
Almost every breach you read about ends with a dump of stolen password data, and whether that dump is a catastrophe or a non-event comes down to one decision the site made long before it was hacked: how it stored passwords. Storing them well means attackers walk away with near-useless data; storing them badly hands over millions of accounts. This is also the mental model behind every password-cracking lab: you cannot understand why some stolen hashes crack in seconds and others resist for years until you understand what a hash, a salt, and a slow hash actually are. Learn it once, from the…
What you'll learn
- password hashing
- salting
- bcrypt
- argon2
- slow adaptive hashes
- how credential storage works
Steps in this lab
- Why storing plaintext passwords is a disaster
- What a hash is: a one-way fingerprint of your password
- Why fast hashes like MD5 and SHA-256 are the wrong tool here
- Salting: why two identical passwords must not share a hash
- Slow adaptive hashes: bcrypt and argon2 are the standard
- Hands-on: generate a real bcrypt or argon2 hash
- Hands-on: hash the same password twice, then verify a guess
- The model to keep