140
password hashing
Store a slow hash, not the password, not SHA-256, not encryption you can undo.
What is password hashing?
A password hash is one-way and deliberately slow: bcrypt, scrypt, argon2, with a unique salt per password. Encryption is reversible and wrong here. A fast hash is what attackers want; they already have rainbow tables for it.
Why does password hashing matter when vibe coding?
Models reach for SHA-256 or store the password “temporarily” to email it back. Name the algorithm and that you cannot recover the password.
How do you do password hashing?
Argon2 or bcrypt via a maintained library. Unique salt. Never log the password. Reset replaces the hash. Do not invent the scheme.
How do you ask a model for password hashing?
Hash passwords with argon2 or bcrypt. Unique salt per password. Never store, log, or encrypt-and-keep the raw password. Do not use SHA-256 or MD5. Password reset replaces the hash; it does not email the old password.
What goes wrong with password hashing?
A pepper in the repo next to the hashes. The pepper is a secret. The salt is not. Do not confuse them, and do not commit the pepper.