How Passwords Are Stored: Hashing in Plain Words
beginner 45 min 3 tasks
Why a well-built website never keeps your actual password, what it keeps instead, and how to tell a strong storage method from a weak one.
By the end of this lesson you can explain what a hash is and why it is one-way, show that a tiny change gives a completely different hash, explain what a salt and a slow hash add, and recognise MD5, SHA-1, SHA-256 and bcrypt by their length or prefix. There is no lab in this lesson: every command is shown together with the exact result it prints, so you can read along. You look at this from the side of a defender or developer checking how an application stores passwords.
Part of these paths
Ready to start hacking?
Launch the lab in your browser. Real Kali, Ubuntu and Windows targets, guided step by step. No setup, no VM downloads.
Updated 2026-11-01