This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Password Storage Cheat Sheet"
From OWASP
m |
m (→Password Storage Rules) |
||
| Line 7: | Line 7: | ||
== Password Storage Rules == | == Password Storage Rules == | ||
| − | # Use a | + | # Use a modern hash |
## SHA | ## SHA | ||
## bcrypt | ## bcrypt | ||
| − | # Use a long | + | # Use a long cryptographically random salt |
## Isolate the salt from the hash | ## Isolate the salt from the hash | ||
# Iterate the hash | # Iterate the hash | ||
Revision as of 19:07, 21 September 2011
DRAFT CHEAT SHEET - WORK IN PROGRESS
Introduction
This article is focused on providing guidance to storing a passwords in order to help prevent password theft.
Password Storage Rules
- Use a modern hash
- SHA
- bcrypt
- Use a long cryptographically random salt
- Isolate the salt from the hash
- Iterate the hash
OWASP Cheat Sheets Project Homepage
