Skip to content
intermediatePhase ·

Password Hashing

Hash passwords with bcrypt, scrypt, or Argon2 - never store plaintext.

40m
0 problems
Topic Progress0%

Password Hashing

Why Hash?

Plaintext storage: DB leak = all passwords compromised
Hashed storage: DB leak = attacker gets hashes (hard to reverse)

Hashing Algorithms

Algorithm Use Case Status
MD5 Passwords DEPRECATED
SHA-256 Passwords Weak
BCrypt Passwords Recommended
Argon2 Passwords Best
PBKDF2 Passwords Good

BCrypt Example (Spring Security)

@Bean
public PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
}

// Hash
String hash = passwordEncoder.encode("rawPassword");

// Verify
boolean matches = passwordEncoder.matches("rawPassword", hash);

Salt

BCrypt auto-generates a unique salt per password. Two identical passwords produce different hashes.

Password Best Practices

Policy Requirements

  • Minimum 8 characters
  • Mix of character types
  • Check against breached passwords
  • No personal information

Storage

  • Use bcrypt/scrypt/Argon2
  • Unique salt per password
  • Appropriate cost factor
  • Never store plaintext

Reset Flow

  1. Verify user identity
  2. Generate single-use token
  3. Send via secure channel
  4. Token expires in 1 hour
  5. Invalidate all existing sessions

Key Points

  • Understanding Password Hashing is essential for production systems
  • Always consider scalability and maintainability
  • Test thoroughly before deploying to production
  • Monitor performance and set up alerting

Common Patterns

  1. Validation: Always validate input at the boundary
  2. Error Handling: Use structured error responses
  3. Logging: Log key events for debugging
  4. Testing: Unit, integration, and load tests
  5. Documentation: Keep docs updated with code changes

Practice Problems

0/3solved
Implement Password Hashing

Design and implement a solution for Password Hashing in a backend system. Consider scalability, error handling, and production readiness.

Solution
// Password Hashing implementation
// Key aspects: validation, error handling, logging, testing

public class PasswordHashing {
    // Production-ready implementation
}
Password Hashing Edge Cases

Identify and handle edge cases for Password Hashing. What happens under high load, with invalid input, or during failures?

Solution
// Edge case handling:
// 1. Null/empty input -> validation
// 2. High load -> rate limiting, queuing
// 3. Failures -> retries, circuit breaker
// 4. Concurrent access -> locks, idempotency
Password Hashing Testing Strategy

Write a testing strategy for Password Hashing. Include unit tests, integration tests, and performance tests.

Solution
// Test plan:
// - Unit: 80% coverage target
// - Integration: API contracts
// - Performance: latency, throughput
// - Chaos: failure injection

Quiz

1. Which algorithm is recommended for passwords?

Question 1 options

2. What is a salt?

Question 2 options

3. What is the primary purpose of Password Hashing?

Question 3 options

4. What is a common mistake when implementing Password Hashing?

Question 4 options

Flashcards

Question

Recommended password algorithm?

Click to reveal answer

Answer

BCrypt or Argon2

Question

What is a salt?

Click to reveal answer

Answer

Random data added before hashing

Question

What is Password Hashing?

Click to reveal answer

Answer

Password Hashing is a key concept in backend development.

Question

When to use Password Hashing?

Click to reveal answer

Answer

Use Password Hashing when building production systems that require reliability, scalability, and maintainability.

Question

Password Hashing best practices

Click to reveal answer

Answer

Follow SOLID principles, write clean code, test thoroughly, document decisions, and monitor in production.

Revision Notes

Key Takeaways

  • 1.Never store plaintext passwords
  • 2.Use BCrypt or Argon2
  • 3.BCrypt auto-adds unique salt
  • 4.Verify with passwordEncoder.matches()

Interview Tips

  • •Know why hashing matters
  • •Explain salt purpose

Cheat Sheet

Password Hashing

  • Never store plaintext
  • Use BCrypt or Argon2
  • Salt: unique per password
  • Verify: encoder.matches(raw, hash)