OWASP Password Storage Cheat Sheet

1. Hashing vs Encryption

   Why passwords are hashed rather than encrypted.

2. When Password Hashes Can Be Cracked

   Offline cracking, GPU attacks and rainbow tables.

3. Salting

   Unique per-password salts.

4. Peppering

   Secret pepper stored outside the database.

5. Work Factors

   Tuning iteration and cost parameters.

6. Argon2id

   Argon2id recommended memory, iteration and parallelism settings.

7. scrypt

   scrypt cost parameters.

8. bcrypt

   bcrypt work factor and 72-byte limit.

9. PBKDF2

   PBKDF2 iteration counts for FIPS-compliant environments.

10. Upgrading Legacy Hashes

    Migrating from weak hashes to modern algorithms.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.