Key derivation and password hashing (Argon2)

In short: You never store passwords in plain text but as the result of a deliberately slow, memory-hungry method (Argon2, bcrypt, scrypt) with salt. That makes brute-force attacks very expensive after a data leak.

In more detail: Normal hashes like SHA-256 are fast, graphics cards try billions per second. Password hashes are tunably expensive: Argon2id demands lots of compute time and memory, which hinders special hardware. A random salt per user prevents rainbow tables and equal hashes for equal passwords.

In Depth

• Salt: Random value per user, stored openly.
• Pepper: Secret addition that is not stored in the database.
• Cost parameters: Time, memory, parallelism. Tune so a login takes about 0.1–0.5 s.
• KDF: Key derivation function, derives a key from a password (PBKDF2, scrypt, Argon2).
• HKDF: Derives further keys from an already strong key.
• Upgrade: Re-hash with stronger parameters at login.
• Never: MD5/SHA-1 or a plain SHA-256 for passwords.

See also: Authenticated encryption (AEAD), OWASP Top 10