Password hashing

Passwords are stored as slow, salted hashes with bcrypt, scrypt or argon2, never encrypted or in plain text. Verifying compares a fresh hash of the attempt against the stored one.

What a session covers

The tutor works through these with you, in conversation and code. A session ends when you have shown them, not when a video does.

Explain why passwords are hashed with a slow, salted function
Hash and verify a password with bcrypt or argon2
Spot the fast hash and explain how a leaked table is cracked

In practice

A few lines that show Password hashing doing its job.

JavaScript

import { hash, verify } from "@node-rs/argon2";

const stored = await hash(password);              // argon2id, random salt
const ok = await verify(stored, attempt);

// Always take the same time whether or not the user exists:
const user = await users.findByEmail(email);
const valid = user ? await verify(user.passwordHash, attempt) : (await verify(DUMMY_HASH, attempt), false);

The common mistake

Watch for

Using a fast hash such as SHA-256, with or without a salt. A leaked table can be cracked at billions of guesses per second; password hashes must be slow on purpose.

What to know first

Your roadmap puts these before Password hashing, unless you already know them.

Routing

How it stays learned

Once a session shows you understand Password hashing, it comes back for review. Each review takes a minute and tells the memory model how well you still know it.

Day 3First recall, while it is fresh
Day 7Second, a week on
Day 18Last, when it has settled

Where it leads

Topics that build on Password hashing.

Sessions versus tokens

Next in the moduleSessions versus tokens →