If so, do you think those websites store your passwords as-it-is in their databases?

The answer is probably not. In today's technological era, this is a very silly mistake a website can do. So, how do they store your passwords? And... What's the need for Hashing your passwords?

After reading this blog post, you'll find out the answer to most of your questions related to "Password Hashing". And if you're a developer, you must learn this concept.

The Problem

When you register your account on a new website, that website stores your username and password along with some other information in its databases. Without that, the website cannot log you in when you visit next time.

So, the question is "Is it secure to store your password as plain text?".

No, it's not! There's a possibility that their employees can read your passwords which can be a threat to your privacy. Also, in case the website suffers from a data breach, your passwords can get exposed to hackers, who can then log into your other social media accounts which share the same password.

The Solution

The solution is to not store passwords as plain text. There should be a way that your passwords can be converted into something no one can understand and is still unique so that websites can verify your passwords.

But... how is that even possible?

Hashing

Hashing is a technology that uses special algorithms to convert your sensitive data into something gibberish.

This gibberish text cannot be translated back into the original text. So, no one knows what the original text was.

Now, let's try solving our problem with Hashing.

What we can do is convert our passwords into 'Hashes', and then store them in the database. This can be depicted as:

1. The server gets your password as "my_password".

2. It converts your password into a Hash.

3. The hash looks like this: "qi8H8R7OM4xMUNMPuRAZxlYUNMPuRA".

4. Finally, the server stores it in the database.

When you log in next time with your new password, the server will generate a hash for your new password and compare it with the original password's hash. If the hash matches, the password is correct. If not, it's incorrect.

Wow! We've found the solution!

NOTE: Hashing is irreversible. It means, after converting your password into a hash, it's impossible to get back the original text.

Irreversible

Because of such nature, if a data breach occurs, all the passwords are pretty safe as the hackers only got the hashes, not the passwords.

Hashing using Python

Read this simple Python Script that converts a password into its hash using the 'Hashlib' Library.

# Import hashlib library
import hashlib

# This is your password
password = "mypassword"

# Encode your password to utf-8 (it's mandatory)
encoded_password = password.encode("utf-8")

# Generate hash for the encoded password
hashed_password = hashlib.sha256(encoded_password)

# Convert the generated hash into text (so that we can print it)
hash_string = hashed_password.hexdigest()

# Print the hash text
print(hash_string)

Output: 89e01536ac207279409d4de1e5253e01f4a1769e696db0d6062ca9b8f56767c8

Here are some points to note:

• No need to install the 'hashlib' library, as it's already installed by default.

• The text must be encoded into "UTF-8" before hashing.

• I've used SHA-256 Hashing Algorithm, which is considered much more secure. But you can use any algorithm of your choice.

Thanks for reading! ❤️

This blog has covered the basics of password hashing. Yet, there's so much more to learn. If you're interested in hearing more about password hashing, please leave a comment!

Also, I'm going to write more blogs on this topic. So make sure you've signed up for the newsletter and followed me!

Thanks for your time!