How to Securely Store Passwords in a Database: A Comprehensive Guide

1. Hash Those Passwords!

Hashing is like turning a password into a secret code that can't be reversed. For example, "ILovePizza" becomes something like "x7b9z2...". If a hacker sees the hash, they can't figure out the original password.

But not all hashing methods are created equal. Some are like flimsy locks that hackers can pick in seconds. Here's what to avoid and what to use:

• Don't use these: MD5 or SHA-1. They're fast, which sounds great, but hackers love fast. They can guess millions of passwords per second with these.
• Use these instead:
  • bcrypt: It's slow (in a good way!) and adds a random "salt" to every password to make it unique.
  • Argon2: The cool new kid on the block, designed to be super tough for hackers to crack.
  • PBKDF2: Another solid choice if you configure it to be slow enough.

import bcrypt

# Turn a password into a hash
password = b"MySuperSecret123"
salt = bcrypt.gensalt()  # Random salt for extra security
hashed_password = bcrypt.hashpw(password, salt)

# Check if a password matches
if bcrypt.checkpw(password, hashed_password):
    print("Yay, the password matches!")

2. Add a Salt (No, Not Table Salt!)

A salt is a random string added to each password before hashing. It's like adding a unique spice to every user's password to make it harder for hackers to crack. Without a salt, hackers can use "rainbow tables" (pre-made lists of hashes) to guess passwords quickly.

Here's how to do it right:

• Every user gets their own unique salt.
• Make it long (at least 16 bytes).
• Store the salt with the hashed password in your database so you can verify it later.

const bcrypt = require('bcrypt');
const saltRounds = 12;  // Higher number = slower (and safer)

// Hash a password
bcrypt.hash('MyCoolPassword', saltRounds, (err, hash) => {
  // Save this hash in your database
});

// Check a password
bcrypt.compare('MyCoolPassword', hash, (err, result) => {
  if (result) console.log("Password's good!");
});

3. Spice It Up with a Pepper

Okay, this one's optional, but it's like adding a secret ingredient to your recipe. A pepper is a single secret key (like "MyAppSecret123") that you add to every password before hashing. Unlike a salt, you don't store the pepper in the database—you keep it in your app's config file or a secure vault.

Why bother? If a hacker gets your database, they'll have the salts and hashes, but without the pepper, they're stuck. It's like locking your safe inside another safe.

pepper = "MySuperSecretPepper"
hashed_password = bcrypt.hashpw(password + pepper, salt)

4. Slow Things Down (On Purpose)

Hackers love speed. If your hashing is fast, they can guess thousands of passwords per second. That's why bcrypt and Argon2 are designed to be slow. You can tweak them to take just long enough to annoy hackers but not bother your users.

import argon2

hasher = argon2.PasswordHasher(
    time_cost=3,      # How many times to run the hash
    memory_cost=65536, # How much memory to use (64MB)
    parallelism=4     # How many threads to use
)
hash = hasher.hash("ILoveTacos")
print(hasher.verify(hash, "ILoveTacos"))  # True if it matches

5. Stop Hackers from Guessing Forever

Even with strong hashing, hackers might try guessing passwords over and over (called a brute-force attack). To stop them:

• Limit login attempts: Only let someone try 5 times before locking them out for a bit.
• Add a CAPTCHA: If someone's acting shady, make them prove they're not a bot.
• Block suspicious IPs: If you see tons of failed logins from one source, block it.

6. Follow the Pros' Advice

The experts at OWASP (a big name in security) and NIST (a government standards group) have some great tips:

• Let users have long passwords (up to 64 characters).
• Don't force weird rules like "must have a symbol and a number." They don't help much.
• Check if a password has been hacked before (use a service like Have I Been Pwned).