Password hashing

Never store passwords as plain text. Store a strong one-way password hash using a modern password-hashing library.

Typical login flow

1. User submits credentials over HTTPS.
2. Server finds the account.
3. Server compares the submitted password with the stored hash.
4. If valid, the server creates an authenticated session or token.

Never log passwords or return them in API responses.

Deep dive

Hashing vs encryption

Password hashing is intentionally one-way. Encryption is designed to be reversible with a key. Passwords should normally be hashed, not encrypted for later recovery.

Additional protections

Use HTTPS, rate-limit login attempts where appropriate, prevent user enumeration, and use secure session/token handling.