Hashed password

How it works

Instead of keeping the password itself, a service runs it through a hashing function and stores the result. At login it hashes what the user typed and compares the two. The function only runs one way, so the stored value cannot simply be reversed.

Good practice adds two things. A salt is a unique random value added for each password, which stops precomputed lookup tables and forces an attacker to crack each hash separately. NIST SP 800-63B requires stored passwords to be salted and hashed with a suitable password hashing scheme, and sets a salt of at least 32 bits. OWASP recommends Argon2id first, with scrypt, bcrypt and PBKDF2 as alternatives under stated settings, and describes an optional pepper, a secret stored separately from the database.

How it shows up in executive exposure

Many breaches expose hashes rather than readable passwords. How serious that is depends on the algorithm. A strong, slow, salted hash may resist cracking for a long time. A fast or unsalted hash can be cracked in bulk, and the result is a plaintext password that joins a credential pair. Weak and commonly used passwords fall first.

WebThreat's CEM works from the records found for a person in breach corpora and leak databases, and an exposed password raises that person's place in the list of what to fix first; see the methodology for the factors.

How to reduce the risk

• Treat a password exposed as a hash as potentially compromised, and change it if it was reused.
• Choose long, unique passwords, which are far harder to crack.
• Turn on multi-factor authentication so a cracked password alone does not open the account.
• If you build login systems, use a recommended algorithm with a unique salt, and consider a pepper.

How it differs from related terms

A plaintext password needs no cracking at all. A hashed password does, so its exposure is a matter of time and effort, not of certainty. Encryption differs from hashing because encrypted data can be decrypted with a key, while a hash has no key to turn it back. A credential pair can hold either form. See also password reuse, which turns one cracked hash into many compromised accounts, and the article on what to do when an executive's password is in a breach.