IT lexicon › Security › Password hashing

Password hashing

Security På svenska → Updated: 2026-10-12

Storing passwords as deliberately slow, salted hashes rather than fast digests.

A fast hash such as SHA-256 lets an attacker test billions of guesses per second on a GPU. Password hashing uses functions that are costly in time or memory by design, and adds a unique salt to each password, so identical passwords produce different hashes and precomputed rainbow tables stop helping.

bcrypt dates from 1999 and is still widely deployed. PBKDF2 was standardised in RFC 2898 in 2000, scrypt was published in 2009, and Argon2 won the Password Hashing Competition in 2015. The point is that the cost can be raised as hardware gets faster.

← Back to the lexicon