How Passwords Are Stored

Understanding how applications store passwords is the foundation of both attacking and defending authentication systems. You will learn why plaintext storage is catastrophic, how hashing works as a one-way function, and why the same password can produce different hashes depending on how it is stored. This lesson explains the technical reality behind every password breach you have ever read about.

Hash Functions Explained

Hash functions are the mathematical backbone of password security, digital signatures, and data integrity verification. You will learn how MD5, SHA-1, SHA-256, bcrypt, and Argon2 work, why some are considered broken for password storage, and what properties make a hash function suitable for security applications. Understanding the difference between a fast hash and a slow hash is critical for both attackers and defenders.

Dictionary Attacks with Hashcat

Hashcat is the world's fastest password cracker, capable of testing billions of hash candidates per second using GPU acceleration. You will learn how to identify hash types, configure Hashcat for different attack modes, and use wordlists like rockyou.txt to crack real password hashes. Dictionary attacks succeed because most users choose passwords that appear in common wordlists.

Brute Force Techniques

Brute force attacks systematically try every possible combination of characters until the correct password is found. You will learn when brute force is practical versus impractical, how to use mask attacks in Hashcat to target specific password patterns, and how online brute force tools like Hydra work against login forms. Understanding brute force helps you design password policies that make it computationally infeasible.

Rainbow Table Attacks

Rainbow tables are precomputed lookup tables that trade storage space for cracking speed, allowing attackers to instantly reverse unsalted hashes. You will learn how rainbow tables work, why they were once the dominant password cracking technique, and how password salting completely defeats them. Understanding rainbow tables explains why salting is a non-negotiable requirement in modern password storage.

Secure Password Policies

Effective password policies balance security with usability — overly restrictive policies often backfire by causing users to write passwords down or use predictable patterns. You will learn evidence-based password policy recommendations from NIST SP 800-63B, how to implement multi-factor authentication, and how password managers solve the human memory problem. This lesson bridges the gap between attacking passwords and defending against those attacks.