Cybersecurity Foundations (Grades 9–12) · lesson 6 of 7 · 15 min
Why passwords are never stored in plaintext Storing passwords in plaintext means a single database breach exposes every user’s password. Instead, systems store a hash — the output of a one-way function. When you log in, the system hashes your input and compares it to the stored hash. Hashing vs. encryption Encryption is reversible — you can decrypt with the key. Hashing is one-way — you cannot reverse a hash to get the original input. For passwords, you want hashing, not encryption. Why MD5 and SHA-1 are not safe for passwords MD5 and SHA-1 are fast — which is exactly the problem. An attacker with a GPU can compute billions of MD5 hashes per second, enabling brute-force and rainbow table attacks. Password hashing algorithms bcrypt: deliberately slow, includes a work factor you can increase as hardware improves. Industry standard for most applications. Argon2: winner of the Password Hashing Competition (2015). Memory-hard — requires large amounts of RAM, making GPU attacks expensive. Recommended for new systems. Salting A salt is a random value added to the password before hashing. Even if two users have the same password, their hashes will differ. Salting defeats rainbow table attacks (precomputed hash lookups). bcrypt and Argon2 automatically generate and store a unique salt per password. Never implement your own password hashing — use a well-audited library.
Password hashing quiz
Two users both have the password “hunter2”. With proper salting, their stored hashes will be:
- Identical — same input produces same hash
- Different — the salt makes each hash unique
- Empty — salted passwords are not stored
- Encrypted, not hashed
- Answer: Different — the salt makes each hash unique
Each user gets a unique random salt prepended to their password before hashing, so identical passwords produce different hashes.
Why is bcrypt preferred over SHA-256 for password storage?
- bcrypt produces longer hashes
- bcrypt is deliberately slow, making brute-force attacks expensive
- SHA-256 does not support salting
- bcrypt is reversible, making verification easier
Answer: bcrypt is deliberately slow, making brute-force attacks expensive
SHA-256 is designed to be fast (for data integrity checks). That speed is a liability for passwords. bcrypt’s tunable cost factor keeps it slow even as hardware improves.
Previous lesson: Authentication factors
Back to Cybersecurity Foundations (Grades 9–12)
Next lesson: MFA and passkeys