IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
How websites store your password
Here is a test for any website. Click "forgot password". If it emails you your old password, leave the site. It keeps your password in a form it can read. Your goal: explain how a good site checks your password without keeping it.
- A good site stores a hash of your password, not the password.
- A salt makes each user's hash different.
- A slow hash makes guessing very costly.
- If a site can email your old password, it stores it badly.
Keep the fingerprint, not the password
A good site never saves your real password. It saves a hash of it (see lesson 5). A hash is a one-way fingerprint. When you log in, the site makes a fingerprint of what you typed. It compares that to the saved one. Same fingerprint means same password, and you get in. The real password was never written down. So a thief who steals the database gets fingerprints, not passwords.
A pinch of salt
There is one problem. Two people who both pick hunter2 get the same fingerprint. Attackers keep huge tables of ready-made fingerprints for common passwords. The fix is a salt. A salt is random extra data mixed into each password before hashing. Now the two hunter2 users have different fingerprints. The ready-made tables are useless. The salt is stored next to the hash. It is not secret. It only has to be different for every user.
Slow on purpose
A plain hash is fast to compute. A thief can also try a billion guesses fast. This attack is called brute force. So passwords use a hash that is slow on purpose. Names you will meet later are Argon2, scrypt and bcrypt. One login still feels instant. But guessing millions of passwords takes a very long time. The salt kills the shortcut. The slowness makes guessing costly.
Zara reviews a small site after a breach. The attackers took the whole user table. It was salted and slow-hashed, so weeks later almost nothing was cracked. Her notes also flag one old system that kept passwords in plain text. Those accounts had to be reset overnight.
| How it is stored | What the thief gets in a breach |
|---|---|
| Plain text | Every password, at once. Game over. |
| Fast hash, no salt | Fingerprints that ready-made tables crack in minutes. |
| Salted, slow hash | Fingerprints that are costly to crack. Strong passwords can take years. |
This is why breach lists still hurt. People reuse one password, so one leaked site opens the rest. You can check yours safely with a trick called k-anonymity. It sends only the first few letters of the fingerprint, never the whole password. Passkeys remove the problem. A passkey replaces the shared secret, so there is no password left to store or leak.
🧪 Interactive lab — enable JavaScript to play with this one.
Curious about a future without passwords? See where your accounts stand with Passkey Check.