How Password Hashing and Salting Protect Stored Passwords

Summary

A beginner’s guide explains how unique salts and slow password-hashing functions protect stored passwords, why fast general-purpose hashes are unsuitable, and how unique passwords and MFA help limit risk.

Key points

• A login system should store password hashes rather than readable passwords; hashing is one-way and supports verification.
• A unique, random salt for each password prevents attackers from reusing precomputed results across accounts, but does not stop guessing.
• Dedicated password-hashing functions such as bcrypt, scrypt, Argon2, and PBKDF2 make each guess more computationally expensive.
• MD5 and SHA-1 are unsuitable for password storage because they are fast general-purpose hash functions.
• Salting does not make a weak password strong, and password hashing does not protect against phishing or keyloggers.
• The article recommends unique passwords and MFA to help limit account risk if a database is stolen.