22.1 How Passwords Are Stored
Changla system password plain text madhe thevat nahi. To ek hash thevto – ek one-way function jo password cha ek fixed output banavto, ani tyatun password parat kadhta yet nahi.
| Method | What it stores | Safe? |
|---|---|---|
| Plain text | The password itself | Never – one leak exposes everyone |
| Hash (MD5, SHA1) | A one-way fingerprint | Weak now – fast to crack, no salt |
| Salted hash | Hash + a unique random "salt" per user | Better – stops precomputed tables |
| Slow hash (bcrypt, Argon2, PBKDF2) | Salted hash that is deliberately slow | Best – cracking becomes very expensive |
A salt is a random value added to each password before hashing, so two users with the same password get different hashes, and precomputed rainbow tables stop working. A slow hash (bcrypt) is designed to take time, so an attacker can only try a few thousand guesses a second instead of billions.
On Linux, password hashes live in /etc/shadow (readable only by root); the format $6$ means SHA-512, $y$ means yescrypt. Old systems used /etc/passwd.
Ravindra Bagale's Tip
Web project banvtana students PHP madhe md5($password) vaprtat – he 2024 madhe chuk aahe! Nehmi password_hash($p, PASSWORD_DEFAULT) (bcrypt) aani password_verify() vapra. Chapter 16 chya reels app madhe aapan hech kela hota – aata kalel ka te ka garjeche hote.
Practice task
In your notes, write the four storage methods from weakest to strongest, and one line each on why. Then check your reels app code and confirm it uses password_hash, not md5.