Secure Password Storage & Credential Recovery
Learn how to hash passwords correctly, defend against credential attacks, and build secure password reset and account recovery flows.
Secure Password Storage & Credential Recovery is a free Secure Coding & OWASP Top 10 for Backend lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Secure Coding & OWASP Top 10 for Backend learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Why Hashing Matters
Storing passwords in plaintext or with weak encoding means a single database breach exposes every user. Passwords must be stored as salted hashes using a slow, purpose-built algorithm.
This lesson covers correct hashing and secure recovery flows.
Hash, Do Not Encrypt
Passwords should be hashed, not encrypted. Encryption is reversible; if the key leaks, all passwords are exposed. Hashing is one-way: you verify by hashing the input and comparing.
- Never use reversible encryption for passwords
- Never use fast hashes like MD5 or SHA-1 alone
Salting
A salt is a unique random value added to each password before hashing. Salts ensure two users with the same password get different hashes, defeating precomputed rainbow tables.
Modern algorithms generate and store the salt for you.
Choosing an Algorithm
Use a deliberately slow, memory-hard algorithm: Argon2 (preferred), bcrypt, or scrypt. Their cost factor makes brute-force attacks expensive even with stolen hashes.
Hashing in Code
Here is a conceptual hashing and verification flow using a bcrypt-style API.
import bcrypt
def hash_password(plain):
return bcrypt.hashpw(plain.encode(), bcrypt.gensalt(rounds=12))
def verify(plain, stored_hash):
return bcrypt.checkpw(plain.encode(), stored_hash)
h = hash_password('s3cret')
print(verify('s3cret', h))Tuning the Cost Factor
The cost factor (rounds) controls how slow hashing is. Set it so a single hash takes around 100-300ms on your hardware: slow enough to deter attackers, fast enough for login. Re-tune it as hardware improves.
Defending Against Credential Stuffing
Attackers reuse leaked credentials across sites. Defend with rate limiting, account lockout with backoff, and checks against known-breached password lists.
- Throttle failed logins per account and per IP
- Reject passwords found in breach corpuses
- Alert users of logins from new devices
Constant-Time Comparison
Comparing secrets must take the same time regardless of how many characters match, or attackers can infer values via timing. Hashing libraries provide constant-time verify functions; use them instead of plain equality.
Secure Password Reset Tokens
Reset flows are a frequent weak point. Generate a high-entropy random token, store only its hash, set a short expiry, and invalidate it after one use.
import secrets, hashlib, time
def create_reset_token():
raw = secrets.token_urlsafe(32)
record = {
'token_hash': hashlib.sha256(raw.encode()).hexdigest(),
'expires_at': time.time() + 900,
'used': False,
}
return raw, record # email raw to user, store recordAvoiding Account Enumeration
Reset and login responses should not reveal whether an email exists. Return the same message regardless, and send the reset email only if the account exists. This prevents attackers from harvesting valid accounts.
Rehashing on Login
When you upgrade algorithms or cost factors, rehash a user's password on their next successful login using the new parameters. This migrates your store gradually without forcing resets.
Quick Check
Test your understanding of secure password storage.
Recap
You learned to hash with salt using Argon2 or bcrypt, tune the cost factor, defend against credential stuffing with rate limiting, compare in constant time, and build single-use expiring reset tokens that avoid account enumeration. Proper credential handling protects users even when the database is breached.
Frequently asked questions
Is the “Secure Password Storage & Credential Recovery” lesson free?
Yes — the full text of “Secure Password Storage & Credential Recovery” is free to read here on the web, and the Secure Coding & OWASP Top 10 for Backend course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Secure Coding & OWASP Top 10 for Backend course, upgrade to CoddyKit PRO.
What will I learn in “Secure Password Storage & Credential Recovery”?
Learn how to hash passwords correctly, defend against credential attacks, and build secure password reset and account recovery flows. You practise Secure Coding & OWASP Top 10 for Backend with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Secure Coding & OWASP Top 10 for Backend?
No prior experience is required. Secure Coding & OWASP Top 10 for Backend on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Secure Password Storage & Credential Recovery” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Secure Coding & OWASP Top 10 for Backend lesson?
Yes. Every Secure Coding & OWASP Top 10 for Backend lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Multi-Factor Authentication (MFA)
- OAuth 2.0 and OpenID Connect
- JWT Security & Best Practices
- Secure Password Storage & Credential Recovery