Password Attacks & Cryptography · intermediate · ~11 min

Password storage: salts, slow hashes, and work factors

State how passwords must be stored and why fast hashes fail.

Overview

Store passwords with a unique per-password salt and a slow, memory-hard KDF (Argon2 > scrypt > bcrypt) tuned via a work factor; optionally a separately-stored pepper. Fast hashes (MD5/SHA-256) are crackable at billions/sec; plaintext or unsalted fast hashes are serious findings.

Why it matters

Password storage determines whether a database breach becomes mass account takeover. Recognising fast/unsalted/plaintext storage and prescribing salted slow KDFs with a sensible work factor is a frequent, high-impact recommendation.

Core concepts

Salt. Unique per password; defeats rainbow tables. Slow KDF. Argon2/scrypt/bcrypt, memory-hard, tunable cost. Work factor. Keep each guess ~tens of ms; raise over time. Pepper. Separate secret. Findings. Plaintext, fast/unsalted hashes, global salt.

Lesson

Passwords need a purpose-built approach — general-purpose fast hashes are exactly wrong.

Why not a plain (fast) hash?

SHA-256 is designed to be fast, so an attacker with a leaked database computes billions of guesses per second on a GPU. Fast = easy to crack.

The right way

  • Salt: a unique random value per password, stored alongside the hash. Defeats precomputation (rainbow tables) and ensures identical passwords hash differently.
  • Slow, memory-hard KDFs: Argon2 (preferred), scrypt, or bcrypt. They're deliberately expensive (tunable work factor / memory cost), so each guess is costly — turning billions/sec into thousands/sec.
  • Pepper (optional): a secret added to all passwords, stored separately (e.g. in an HSM/env), so a DB leak alone isn't enough.

Work factor

Tune the cost so a login takes ~tens of milliseconds today, and raise it over time as hardware improves. This is the dial that keeps slow hashes slow.

What you'll find (and report)

Plaintext passwords, fast unsalted hashes (MD5/SHA-1/SHA-256), or a single global salt are serious findings — a database leak becomes mass account compromise. Recommendation: migrate to Argon2/bcrypt with per-password salts and an appropriate work factor.

Summary

Correct password storage means per-password salts plus a slow, memory-hard KDF (Argon2/bcrypt) with a maintained work factor — the opposite of a fast hash. Fast, unsalted, or plaintext storage turns a DB leak into mass compromise.

Practice with these exercises