Backend & systems·Security and identity
you store a deliberately slow one-way hash with a per-user salt, so a stolen database is not a list of passwords.
Password hashing
Also calledbcrypt, argon2, salt
Storing a slow, salted, one-way derivation of a password rather than the password or a fast hash of it. Slowness is the feature: bcrypt, scrypt and argon2 exist to make offline guessing expensive. General-purpose hashes like SHA-256 are wrong here precisely because they are fast, and the work factor needs raising as hardware improves.