Password Hashing
Password hashing is the process of converting a plaintext password into a fixed-length, scrambled string using a one-way cryptographic algorithm so that the original password cannot be recovered.
What is Password Hashing?
Password hashing is a cryptographic technique that transforms a user's plaintext password into an unrecognizable fixed-length string using a one-way hash function. Unlike encryption, hashing is irreversible — there is no "decryption" key to recover the original input. This means even if an attacker gains access to the stored hashes, they cannot directly determine the plaintext passwords.
Common hashing algorithms used for passwords include bcrypt, Argon2, PBKDF2, and scrypt. These are deliberately slow and computationally expensive to resist brute-force attacks. A crucial practice is salting — appending a unique random value to each password before hashing — which ensures that identical passwords produce different hashes and prevents rainbow table attacks.
Password hashing is a fundamental security practice for any application that authenticates users. It ensures that credential databases remain useful for verification (the system hashes the login attempt and compares it to the stored hash) without exposing users to credential theft in the event of a data breach.
Analogy
Password hashing is like blending a smoothie and then trying to separate it back into whole fruits — it is deliberately impossible to reverse. When a website stores your password as a hash, even if hackers steal the database, they get only the "blended" version, not your actual password.
Types and Use Cases
- Web Application Authentication: User passwords are hashed with bcrypt and stored in the application database for login verification.
- Enterprise Directory Services: Active Directory and LDAP directories hash passwords using NTLM or Kerberos protocols.
- API Token Derivation: Derived credentials for API access are often created by hashing a secret key with a unique salt.
- Zero-Knowledge Proof Systems: Password hashing enables password verification without the server ever knowing the plaintext password.
How it Works
{
"passwordHashing": {
"algorithm": "bcrypt",
"costFactor": 12,
"salt": "a1b2c3d4e5f6g7h8i9j0",
"hash": "$2a$12$LJ3m4ysnL8x7QpZ5R6s7UuT1V2W3X4Y5Z6a7b8c9d0e1f2g3h4i5j6k7l8m9n0"
},
"verification": {
"inputMatches": true
}
}Password Hashing vs Password Encryption
Password Hashing
Password Encryption
Password hashing is a one-way process that cannot be reversed,
password encryption is two-way and can be decrypted with a key.
Hashing is used for password storage and verification,
encryption is used for transmitting or storing data that needs to be recovered later.
Hashing with salting protects against rainbow table attacks,
encryption security depends entirely on key management and protection.
Best Practices for Password Hashing
- Always use a strong, slow hashing algorithm such as Argon2, bcrypt, or PBKDF2 with a high cost factor.
- Generate a unique, cryptographically random salt for every password and store it alongside the hash.
- Never use fast general-purpose hash functions like MD5, SHA-1, or plain SHA-256 for password storage.
- Consider using pepper (a server-side secret added to the hash) alongside salt for additional protection.
How LoginRadius Powers Password Hashing
LoginRadius implements secure password hashing using bcrypt with unique per-user salts, following OWASP and NIST best practices. The platform never stores or transmits passwords in plaintext, supports configurable cost factors, and can be integrated with custom password hashing requirements for enterprise customers with specific compliance needs.
Resources
FAQs
If a database containing plaintext passwords is breached, attackers immediately gain access to every user account. Hashing ensures that even if the database is stolen, the actual passwords remain computationally infeasible to recover.
Yes, but each password must have a unique salt. With unique salts, even if two users have the same password, their hashes will be completely different, preventing attackers from identifying common passwords.
LoginRadius uses industry-standard hashing algorithms (bcrypt with configurable cost factors) and automatically applies unique salts to every password. The platform follows OWASP guidelines and NIST recommendations for secure credential storage, ensuring passwords are never stored or transmitted in plaintext.