Password Security: How not to Store Passwords/

...

/

Storing Hashed Passwords

Storing Hashed Passwords

Learn about password hashing, why hashes alone are not enough, and how to fix a database of insecure password hashes.

We'll cover the following...

Password hashes

Hash functions let you prove you know a secret without having to say the secret. They work by computing a checksum from the password. If another password produces the same checksum, the inputs are the same.

Here’s a simple hash algorithm to illustrate the idea:

Press + to interact
def dumb_hash(value):
    sum = 0
    for b in bytes(value, 'utf-8'):
        sum += b
    return sum
print(dumb_hash("apple"))

This is a bad algorithm, but it’s just to illustrate the point. Every time you pass apple you’ll get 530, but there’s no algorithm to get from 530 back to apple. Try modifying the input in the above program, and you will see a different output. Hash functions are wonderful for password storage because you can just store the output. Then, to validate a password, calculate the new hash; if the hashes match, the password is correct.

You can pick from several hash algorithms. MD5 and SHA-1 should not be used for passwords anymore. ...