Semicolony ELI5 · comic

Password hashing & salting.

Store a fingerprint of the password, with grit mixed in so two alike never match.

Save it as-is? No.

1
The cardinal rule: never store the raw password. Ever.
2
Store a one-way fingerprint instead — easy to make, impossible to reverse.
3
Mix in random “salt” first, so identical passwords get different fingerprints.
Fingerprints match.

4
At login, fingerprint the attempt the same way and compare. Match? You’re in.
5
Use a deliberately slow hash (bcrypt), so guessing billions is painfully expensive.
…useless to me.

6
A stolen database is now near-useless — just fingerprints, no keys.

Store a salted, slow fingerprint — never the key itself.

Semicolony semicolony.dev/eli5/password-hashing/comic