All courses › Databases, Networks and Security › Hashing

Hashing

A hash function turns data of any length into a fingerprint of fixed length. The same input always gives the same hash, but working backwards is practically impossible. Passwords are therefore stored as salted hashes, not as plaintext.

h = H(\text{salt} \,\|\, \text{password})

stored password hash

2^{n}

number of possible hash values with n bits

Symbols

$H$	hash function, e.g. SHA-256
$\text{salt}$	random value per user
$\\|$	concatenation

Example

At login the password is hashed with the same salt and compared with the stored hash. The password itself is never stored.

Use a slow password hash like bcrypt or Argon2, not a fast hash like MD5.

Practise cyber security for free →

← Encryption

Part of Databases, Networks and Security: Cyber security.