How Websites Store Passwords: Hashing and Salting

A well-built website never stores your password as plain text. It stores a hash: the output of a one-way function that turns your password into a fixed-length string that cannot simply be reversed.

How hashing works

When you create an account, the site hashes your password and saves the hash. When you log in, it hashes what you typed and compares the two. If they match, you are in. The site never needs to know your actual password.

Why salts matter

If two users choose the same password, they would get the same hash, and attackers could use precomputed tables of hashes for common passwords. A salt is a random value generated for each user and combined with the password before hashing. Identical passwords then produce different hashes, and precomputed tables become useless.

Fast vs slow hashes

General-purpose hash functions such as SHA-256 are designed to be fast, which is bad for passwords: attackers can test billions of guesses per second on graphics cards. Password-specific algorithms are deliberately slow and memory-hungry:

• bcrypt
• scrypt
• Argon2 (winner of the Password Hashing Competition)
• PBKDF2 with a high iteration count

These can reduce an attacker's guessing rate by many orders of magnitude.

Why this affects your password

You cannot see how a website stores your password. Some still use weak methods. A long random password from a password generator stays safe even when storage is poor, while a short or common password may be cracked quickly after a breach.

For developers

Use your language's built-in password hashing function, such as password_hash() in PHP, which uses bcrypt by default and handles salting automatically. Never invent your own scheme, and never encrypt passwords in a way that lets you decrypt them.

Frequently asked questions

What is password hashing?

What is password hashing? It turns a password into a fixed-length value with a one-way function, so the website can check your password without storing it.

What is a salt in password hashing?

What is a salt in password hashing? A salt is a random value added to each password before hashing so identical passwords get different hashes. A salted hash defeats rainbow tables, which are precomputed lists of hashes.

Bcrypt vs Argon2: which is better?

In the bcrypt vs Argon2 comparison, both are good password hashing algorithms. Argon2 is newer and resistant to GPU attacks through memory hardness; bcrypt is older and widely supported. Either is far better than fast hashes such as MD5 or SHA-256 alone.