Hash un contraseña y verificar it later sin storing el plaintext
Usar un lento contraseña-hashing función (bcrypt/PBKDF2/scrypt) a almacenar un salted hash, luego verificar un candidate contraseña against it.
- 1
Never store passwords in plaintext or with fast hashes (MD5/SHA-256) — they are trivially brute-forced. Use a slow, salted KDF (bcrypt, scrypt, PBKDF2) that deliberately costs CPU/memory per attempt, making bulk cracking infeasible.
- 2 Generador de hash bcrypt →
Enter the password and a cost factor (10-12 for interactive, 12-14 for sensitive). The tool outputs a self-describing hash containing the algorithm, cost, salt, and digest.
- 3 Comparador de hashes →
To verify: enter the candidate password and the stored bcrypt hash. The tool re-hashes with the embedded salt and cost and compares in constant time — returns true/false without revealing timing information.
- 4 hash → crc32
Use the hash-and-verify chain to test the full lifecycle: hash a password, then verify a correct and an incorrect candidate in one pass.
Preguntas frecuentes
- Why can't I use SHA-256 for password hashing?
- SHA-256 is fast — a GPU can compute billions per second. bcrypt/scrypt are deliberately slow and memory-hard, making each guess cost milliseconds. This asymmetry is what protects slow hashes against offline brute force.
- What cost factor should I choose?
- Choose the highest cost that still meets your latency budget. For bcrypt, cost 10 takes ~100ms, cost 12 ~400ms, cost 14 ~1.6s. Increase the cost as hardware speeds up — the hash embeds the cost so old hashes still verify.