intermediatePassword Security: Encoding, Encryption & Hashing
What's wrong with using plain SHA-256 to hash passwords?
SHA-256 is a fast, general-purpose hash designed for data integrity (checksums), not for password storage. Its speed is a liability here — modern GPUs can compute billions of SHA-256 hashes per second, making brute-force and dictionary attacks against leaked hashes fast and cheap. Purpose-built password hashes like BCrypt/Argon2 are deliberately slow and often memory-hard, making large-scale cracking far more expensive.
Ready to master this question?
Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.
Sign in to generate a response