Password Security & Hashing

Let's think about it this way for a second

Hashing is a mathematical function that turns a password into a fixed-length, one-way string that can't be reversed — even if the database leaks, an attacker can't work backward from the hash to the original password (as long as a modern algorithm like bcrypt or Argon2 is used). A salt is a random value added to each individual password, so even if two users have the same password, their hash results come out different — this defends against rainbow table attacks. Brute-force attacks (trying every possible combination) and dictionary attacks (trying a list of common passwords) are the two main password-cracking methods — password strength and complexity make both of these harder.

Let's connect it to a real-world scenario

Think about a weak database design (MD5 hashing, no salt) in a database leak scenario — an attacker can crack passwords in just a few minutes using a pre-computed rainbow table (MD5 hash → common password mapping). With bcrypt + salt, cracking becomes computationally expensive instead, because the algorithm is intentionally designed to be slow. Which hashing algorithm a developer chooses has a direct impact on user password security.

Hashing = a function that turns a password into a one-way, fixed-length string
Salt = adding a random value to each password (to defend against rainbow tables)
Brute-force/Dictionary Attack = the two password-cracking methods

Let's look at it together

text

Weak (MD5, no salt):
  password "123456" -> always the same hash
  -> attacker can precompute a lookup table (rainbow table)
  -> cracked instantly

Strong (bcrypt, with salt):
  password "123456" + random salt -> unique hash per user
  -> algorithm is intentionally slow (built-in "work factor")
  -> cracking is computationally expensive even at scale

You should see

You'll be able to explain how hashing, salting, and brute-force attacks relate to one another.

Try it in 5 minutes

Hash the weak password 'password123' with MD5 (no salt) using the `echo -n "password123" | md5sum` command — then reverse-search that hash with an online 'MD5 hash lookup' tool (for educational purposes, using only your own test password).

A quick word of caution

Don't practice cracking or brute-forcing against real-world credentials (your own accounts, a colleague's accounts) — only practice with your own test data (passwords you created yourself).