Mohammed Chami
.NET Developer | Content Creator
When users create an account, they trust the system to protect their credentials.
Unfortunately, not all password storage methods provide the same level of security.
In this article, we’ll walk through password storage techniques from the least secure to modern best practices, explaining the risks and improvements at each step.
1. Storing Passwords in Plain Text (Extremely Insecure)
This is the worst possible approach.
Passwords are stored exactly as users type them, without any protection.
Why this is dangerous:
- A database breach instantly exposes all passwords
- Employees or administrators can see user credentials
- Users often reuse passwords, leading to wider compromise
Plain text storage should never be used under any circumstances.
2. Encrypting Passwords (Not Recommended)
A slightly better approach is encryption, where passwords are encrypted using a secret key before being stored.
What improves:
- Passwords are no longer directly readable
- Adds a layer of protection compared to plain text
Why it’s still unsafe:
- Encryption is reversible (two-way)
- The secret key must be stored somewhere
- If the key is leaked or stolen, all passwords can be decrypted
- Malicious insiders could access decrypted passwords
Encryption is suitable for sensitive data, but not for passwords.
3. Hashing Passwords (A Major Improvement)
Hashing transforms a password into a fixed-length value using a one-way function.
When a user logs in:
- The entered password is hashed
- The result is compared to the stored hash
Benefits:
- Hashes cannot be reversed
- Even the server cannot retrieve the original password
Limitations:
- Attackers can hash common passwords and compare results
- This is known as a dictionary attack
- Large precomputed datasets are called rainbow tables
- Identical passwords produce identical hashes
Hashing alone improves security but is still insufficient.
4. Hashing with Salt (Stronger Protection)
A salt is a random value added to each password before hashing.
hash = Hash(password + salt)Each user gets a unique salt stored alongside their hash.
Advantages:
- Identical passwords now produce different hashes
- Rainbow tables become useless
- Each account must be attacked individually
Remaining risk:
- Modern GPUs can still perform extremely fast brute-force attacks
Salt improves security significantly, but attackers can still leverage powerful hardware.
5. Slow and Memory-Hard Hashing (Modern Best Practice)
To counter modern hardware, specialized password-hashing algorithms were created.
Common choices:
- bcrypt
- scrypt
- Argon2 (recommended today)
Why these work:
- Built-in salting
- Configurable work factor (cost)
- Intentionally slow
- Memory-intensive, reducing GPU effectiveness
Result:
- Attack speeds drop from billions of guesses per second to thousands
- Cracking becomes expensive, slow, and impractical
This is the recommended way to store passwords in modern systems.
6. Not Storing Passwords at All (OAuth and Social Login)
Another approach is delegating authentication to trusted providers such as:
- GitHub
- Microsoft
Benefits:
- No passwords stored in your database
- Breaches expose far less sensitive information
- Security handled by specialized providers
Trade-offs:
- Dependence on third-party services
- Some users prefer traditional login methods
When implemented correctly, OAuth can significantly reduce risk.
Final Thoughts
There is no 100% secure solution.
The goal of good security is to:
- Slow attackers down
- Increase the cost of attacks
- Make your system an unattractive target
Recommended approach today:
- Use Argon2 (or bcrypt if Argon2 isn’t available)
- Always use unique salts
- Implement rate limiting and monitoring
- Consider OAuth where appropriate
If attacking your system isn’t worth the effort, you’ve done your job.
