Secure password storage: salts, peppers, and algorithm choice

▤ Summary

This article explains how to store passwords securely and compares major hashing approaches. It covers salt and pepper concepts, why fast hashes like MD5 and SHA-256 are unsuitable, and how rainbow tables and GPU attacks influence choices. It then compares Argon2id, bcrypt, scrypt, and PBKDF2, including tuning parameters and implementation examples in Python, Node.js, and Spring Security. The piece also stresses constant-time comparison and warns against pre-hashing passwords with weak algorithms.

▦ Linked Companies