hashing-passwords

Hash passwords with bcrypt or argon2 using automatic salting rather than storing raw credentials. Bcrypt with cost 12+ and argon2id both prevent attackers from reversing hashes even if your database is compromised, making plaintext storage obsolete.

Both bcrypt and argon2id are cryptographically secure hashing algorithms with built-in salting. Argon2id is newer and resistant to GPU attacks; bcrypt is battle-tested and widely supported. Choose based on your security posture and platform availability.

No. Base64 is encoding, not encryption or hashing—it's easily reversed and provides zero security. Always hash passwords with bcrypt or argon2; encoding alone leaves credentials exposed if your database is breached.

Use hash comparison functions built into bcrypt or argon2 libraries to securely compare user input against the stored hash. Never manually compare strings, which exposes timing vulnerabilities and defeats the purpose of hashing.

No. Store API keys in environment variables or secure secret-management systems, not in code or databases. Treat them as sensitive credentials but avoid hashing them; instead, use encryption or external vaults.

Hashing protects weak passwords against database breaches, but weak passwords remain vulnerable to brute-force attacks offline. Enforce minimum strength requirements—length, complexity—before hashing to reduce attack surface.