How Password Security Really Works: Hashing, Salting, and Why Managers Win

A well-built site does not know your password

This surprises people, but it is the whole point. When you create an account on a responsibly built site, your password is not stored in a column somewhere. Instead it is run through a one-way function called a hash, and only the result is stored. A hash turns any input into a fixed-length scrambled string, and it is designed so that you cannot run it backwards to recover the original.

When you log in later, the site hashes what you typed and compares it to the stored hash. If they match, you are in — without the site ever keeping your actual password. That is why a good service can never email you your original password; it genuinely does not have it. If a site can send you your old password in plain text, that is a serious red flag about how it is built.

Why hashing alone is not enough: salting

There is a catch. If two people use the same password, a plain hash produces the same output for both, and attackers precompute huge tables of common passwords and their hashes. To defeat this, each password gets a unique random value called a salt, mixed in before hashing. Now identical passwords produce completely different stored hashes, and precomputed tables become useless.

Slow on purpose

General-purpose hash functions are fast, which is great for most computing and terrible for passwords, because fast also means an attacker can try billions of guesses per second. Purpose-built password hashing algorithms such as bcrypt, scrypt, and Argon2 are deliberately slow and memory-hungry. Being slow barely affects a single honest login but makes large-scale guessing painfully expensive. If you build a login system, use one of these — never a bare, fast hash.

What makes a password hard to guess

Attackers rarely guess randomly. They start with leaked password lists, dictionary words, names, dates, and predictable substitutions. That means length and unpredictability beat cleverness. A short password full of symbols is often weaker than a long, random-feeling passphrase.

• Length is the single biggest factor — aim for long passphrases, not short complex ones.
• Never reuse a password across sites. One breach then unlocks everything else.
• Avoid anything guessable from your public life: names, birthdays, teams, pets.
• Randomness beats patterns. "Correct-horse-battery-staple" style phrases are strong because they are unpredictable, not because they are complex.

Why password managers win

The advice above has a problem: humans cannot remember dozens of long, unique, random passwords. A password manager solves this cleanly. It generates a different strong password for every site, stores them encrypted behind one master password you actually remember, and fills them in for you. You trade dozens of weak reused passwords for one strong secret plus a vault.

A good manager also quietly protects you from phishing: it will not autofill your bank password into a lookalike site, because the web address does not match. That mismatch is a warning worth paying attention to.

Multi-factor authentication: the safety net

Even a strong password can leak. Multi-factor authentication (MFA) adds a second requirement — usually a code from an app or a hardware key — so a stolen password alone is not enough to get in. App-based codes and hardware keys are meaningfully stronger than codes sent by text message, which can be intercepted. Turning on MFA for your email is the highest-value ten minutes you can spend, because your email is the reset path for everything else.

The short version

1. Good sites store a salted, slow hash of your password, never the password itself.
2. Length and uniqueness matter more than symbols and cleverness.
3. Use a password manager so every account gets a unique strong password.
4. Turn on multi-factor authentication, starting with your email.