Why You Hash Passwords Before Storing Them — A Developer's Guide

If your database leaks tomorrow and you stored passwords as plain text, every one of your users is compromised. Not just on your site, but on every other site where they reused that password. Password hashing is not optional. It's one of the most basic security responsibilities a developer has.

Why you can't use SHA-256 for passwords

SHA-256 is designed to be fast. That's a feature for file verification but a bug for password hashing. A modern GPU can compute billions of SHA-256 hashes per second, meaning an attacker who gets your database can brute-force common passwords in minutes.

Password hashing algorithms are intentionally slow. They're designed to take 50-300ms per hash, which is imperceptible to a user logging in but makes brute-forcing astronomically expensive.

bcrypt: the standard choice

import bcrypt from "bcryptjs";

// Hashing a password before storing
const saltRounds = 12; // higher = slower = more secure
const hash = await bcrypt.hash("user_password_here", saltRounds);
// "$2b$12$R9h/cIPz0gi.URNNX3kh2OPST9/PgBkqquzi.Ss7KIUgO2t0jWMUW"

// Verifying a login attempt
const isMatch = await bcrypt.compare("user_password_here", storedHash);
// true or false

The $2b$12$prefix encodes the algorithm version and cost factor. The salt is also included in the hash string, so you don't need to store it separately.

Argon2: the modern recommendation

Argon2 won the Password Hashing Competition in 2015 and is now the recommended algorithm. It's resistant to both GPU attacks and memory-constrained attacks. If you're starting a new project, consider Argon2 over bcrypt:

import argon2 from "argon2";

const hash = await argon2.hash("user_password_here");
const isMatch = await argon2.verify(hash, "user_password_here");

What never to do

• Never store plain text passwords
• Never encrypt passwords (encryption is reversible; hashing is not)
• Never use MD5 or SHA-1 for passwords
• Never use SHA-256/SHA-512 without a proper password hashing library
• Never implement your own hashing scheme

Explore hash functions with our Hash Generator. Note that production password hashing should always use bcrypt or Argon2, not the hashes in that tool.