Password Storage Reference
Reference 为安全 password storage: 哈希, salting, 和现代最佳实践.
Storage Requirements
Passwords must never be stored in plaintext or with reversible encryption. A salt (unique per password) prevents rainbow table and precomputation attacks. The hash function must be slow and memory-hard to resist GPU/ASIC brute force. A pepper (server-side secret) adds protection against database-only compromise. The work factor must be tunable and periodically increased as hardware improves. Password history prevents reuse of recent passwords.
- plaintext
- Never acceptable
- salt
- Unique per password
- pepper
- Server-side secret
fatal breachprevents precomputationHMAC with keyModern Recommendations
Argon2id is the PHC winner and recommended default (RFC 9106). bcrypt is battle-tested with a 72-byte password limit. scrypt is memory-hard with tunable parameters. PBKDF2 is FIPS-standardized but not memory-hard (weaker vs GPU). SHA-256/512 alone are too fast for password hashing. Pre-hash passwords with SHA-512 if exceeding bcrypt's 72-byte limit. Verify hashes in constant time. Rate-limit login attempts to slow online attacks.
- Argon2id
- Recommended default
- bcrypt
- Battle-tested
- rate limit
- Slow online attacks
RFC 910672-byte limitper-account + per-IP