Secure › Module 5 › Lesson 2
Password Hashing
bcrypt and Argon2 literacy — hash passwords in YOUR repo, never crack kits on stranger dumps.
Visual · password_hashing
Password hashing literacy. bcrypt/Argon2 named. $MY_REPO only. Original Cyberlium.
Opening
Store verification tokens, not passwords — bcrypt or Argon2 on YOUR auth code, not hashcat on stranger breaches.
Password hashing uses slow adaptive algorithms — bcrypt and Argon2 are named standards — with unique salt per user so offline cracking is expensive. Developers call library APIs (bcrypt.hash, Argon2id) in $MY_REPO auth module — never roll your own SHA1 loop. Cyberlium teaches wiring hash verify on signup/login in your toy app — not running hashcat, John, or crack kits on leaked databases you do not own. You will NOT treat breach dumps as homework material. Next: Never Plaintext.
1. Adaptive hashes with salt
bcrypt embeds cost factor; Argon2id resists GPU cracking with memory cost. Each user gets unique salt — library generates it. Store hash string only, never plaintext password column.
On $MY_REPO, implement or document signup hash and login verify using bcrypt or Argon2 library — local test users only.
Command guide
Try these commands — Adaptive hashes with salt
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Password storage — https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html Argon2 — https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#argon2id
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3 sudo apt install openssl
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
Command — copy this
choco install openssl
═══ LINUX / macOS ═══
Command — copy this
python3 -c "import hashlib; print('demo NOT for passwords:', hashlib.sha256(b'lab').hexdigest()[:16])"
echo 'lab-demo-password' | openssl passwd -6 -stdin 2>/dev/null | head -c 40; echo '...'Primary tools to practice this lesson: python3, openssl. Reference sites: Password storage (https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html); Argon2 (https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#argon2id). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Literacy, not cracking sport
Understanding hashes helps you code verify() correctly — not justify running crack kits on Have I Been Pwned samples or classmate leak rumors.
Defenders detect credential stuffing; developers never store reversible 'encrypted' passwords with hardcoded AES key in source.
3. No crack-kit labs on stranger data
hashcat rules on stranger dump files is out of scope — illegal and unethical. Lab users: testuser / local password you create in $TOY_APP only.
Ship: hash algorithm name + library call note. Next: Never Plaintext.
4. What you ship: password hash implementation note for $TOY_APP
bcrypt or Argon2id named. signup hash + login verify in $MY_REPO. NEVER crack kits on stranger dumps. chmod 600.
5. What you record before the next lesson
Date. Algorithm and library. Local test user only. File t17-m05-l02-password-hashing.txt chmod 600.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
hashcat a public breach dump 'to learn.' Store MD5(password) in $TOY_APP.
Right
Wire bcrypt or Argon2 in $TOY_APP auth. Next: Never Plaintext.
Mission: password hash wiring
1) Choose bcrypt or Argon2id library in $MY_REPO. 2) Hash on signup, verify on login. 3) Local test user only — no stranger dumps. Never run crack kits on leaks.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor about library API — not hashcat wordlist flags.
Knowledge Check
APPLY: Password storage in YOUR app should use:
Multiple choice
Knowledge Check
APPLY: True or False: Running hashcat on stranger breach dumps is Cyberlium homework.
True or False
Knowledge Check
APPLY: bcrypt cost factor primarily:
Multiple choice