How should I store passwords and secrets?
Understand the concept
Password hashing turns a password into a one-way verification value using an intentionally expensive algorithm. Secret management protects credentials that the application must be able to use again, such as database passwords or API keys. Passwords should not be reversibly encrypted just so they can be compared at login.
Important ideas
-
Hash passwords with a suitable password-hashing algorithm and a unique salt.
-
Store app secrets in a secret manager and grant only required access.
-
Rotate exposed credentials; removing them from the latest commit is not enough.
-
A salt prevents identical passwords from producing identical stored hashes; cost settings should be chosen for the actual server workload.
Can you explain it without the notes?
How should I store passwords and secrets?
Use your own words. Explain an example and one limitation before checking the explanation.
Check your explanation
Password hashing turns a password into a one-way verification value using an intentionally expensive algorithm. Secret management protects credentials that the application must be able to use again, such as database passwords or API keys. Passwords should not be reversibly encrypted just so they can be compared at login.
Turn this concept into a clear answer.
- Hash user passwords, protect reusable credentials, and never confuse encoding such as Base64 with encryption.
Adapted from 08_PERFORMANCE_SECURITY.md · “How should I store passwords and secrets?”. Examples are study fragments; framework behavior can depend on your version.