A hash function turns variable-length input, such as a password, into a fixed-length output called a hash. The process is one-way, so databases can verify passwords without storing them in plain text. section 7.4
Use password hashing carefully:
- Hash passwords with a recognized algorithm such as bcrypt or SHA-512. section 7.4
- Add a random salt before hashing to make brute-force and rainbow-table attacks harder. section 7.4
- Store the resulting data at a size that fits its encoding. section 7.4
Password storage and login
A bcrypt result may be 40 bytes of binary data. Base64 encoding expands it to 60 characters, so the password column should use CHAR(60). During login, hash the supplied password in the same way and compare the result with the stored hash. section 7.4
