Skip to content

Never store a password in plain text: hash it with Argon2

Your users' passwords are stored in plain text, MD5 or SHA-1: if the database leaks, they can be used right away.

Best practiceBeginnerBest practicesPHPTypeScriptPython
<?php// Inscription$hash = password_hash($password, PASSWORD_ARGON2ID);// Connexionif (password_verify($password, $hash)) {    // Mot de passe correct}

Explanation

A hash is irreversible: you never store the password, only its fingerprint. Argon2id is today's recommended algorithm: it is deliberately slow and memory-hungry, which makes brute-force attacks very expensive.

  • Never use MD5, SHA-1 or plain SHA-256 for passwords: they are designed to be fast.

  • The salt (random value) is generated and stored inside the hash automatically: nothing to manage yourself.

  • Use a column of at least 255 characters to store the hash.

To migrate an existing database, re-hash each password at the user's next successful login.

Share

Related tips