Storing PasswordsHow passwords must be stored, and what each term in the recipe is for.ComputingThe current consensus, in the order the operations happen.1Never store the passwordNot encrypted, not encoded. Only a hash of it.2Use a slow, purpose-built hashArgon2id, scrypt or bcrypt. Never MD5, SHA-1 or plain SHA-256.3Salt every passwordA unique random value per user, so identical passwords hashdifferently.4Tune the cost factorSlow enough to hurt an attacker, fast enough for login — aim near250 ms.5Rehash on login when the cost changesYou have the plaintext at that moment and nowhere else.WHY SLOW IS THE POINTSHA-256: billions of guesses per secondbcrypt at cost 12: a few per secondThe slowness is the entire defenceGeneral-purpose hashes are designed to be fast. That is exactly thewrong property for a password.Storing Passwordslearnposters.com
Storing Passwords — printable computing wall chart from LearnPosters. Free vector PDF, US Letter and A4.

Storing Passwords, step by step

The current consensus, in the order the operations happen.

  1. Never store the passwordNot encrypted, not encoded. Only a hash of it.
  2. Use a slow, purpose-built hashArgon2id, scrypt or bcrypt. Never MD5, SHA-1 or plain SHA-256.
  3. Salt every passwordA unique random value per user, so identical passwords hash differently.
  4. Tune the cost factorSlow enough to hurt an attacker, fast enough for login — aim near 250 ms.
  5. Rehash on login when the cost changesYou have the plaintext at that moment and nowhere else.

Why slow is the point

  • SHA-256: billions of guesses per second
  • bcrypt at cost 12: a few per second
  • The slowness is the entire defence

General-purpose hashes are designed to be fast. That is exactly the wrong property for a password.

Questions about the Storing Passwords poster

What’s on the Storing Passwords poster?
5 numbered steps, with a full worked run-through. The current consensus, in the order the operations happen. Never store the password — Not encrypted, not encoded. Only a hash of it.; Use a slow, purpose-built hash — Argon2id, scrypt or bcrypt. Never MD5, SHA-1 or plai…; Salt every password — A unique random value per user, so identical passwords hash dif…; Tune the cost factor — Slow enough to hurt an attacker, fast enough for login — aim n…; Rehash on login when the cost changes — You have the plaintext at that moment and now…. General-purpose hashes are designed to be fast. That is exactly the wrong property for a password.
Who is the Storing Passwords poster for?
Storing Passwords belongs to the Computing section rather than to a school year, because computing is not something one grade owns. Anyone learning security can pin it up — a beginner, a student mid-course, or someone revising years later.
When should you use the Storing Passwords poster?
Never write your own. Use the library your language ships and set the cost factor. A wall chart earns its place by being glanceable from where the work is happening, so Storing Passwords belongs on the wall where that computing work actually happens, within glancing distance, rather than filed away.
What other posters go with Storing Passwords?
Secrets, AuthN vs AuthZ and Hashing vs Encryption sit alongside Storing Passwords in the Computing section. Printed together they make a wall rather than a single sheet, which is how a reference set actually gets used.SecretsAuthN vs AuthZHashing vs Encryption
Is the Storing Passwords poster free to download and print?
Yes. Storing Passwords downloads as a free PDF with no account, no email and no watermark, like everything else in the Computing section. Print as many copies as you like for a home, a classroom, a library or a tutoring group; reselling the file is the only thing the licence rules out.Read the licence
What size does the Storing Passwords poster print at?
Storing Passwords is a vector PDF laid out for US Letter, and prints on A4 with Fit to page — the same file, no separate download. Because every mark on it is drawn rather than photographed, it stays sharp enlarged to A3, A2 or A1 at a copy shop. Colour carries emphasis only, so a greyscale print of Storing Passwords loses nothing.Printing guide

Related posters

Charts that sit alongside Storing Passwords on the same wall.

Browse every Computing poster, or start from the full catalogue.