Password Hash Upgrade on Rietta Cybersecurity https://rietta.com/glossary/password-hash-upgrade/ Recent content in Password Hash Upgrade on Rietta Cybersecurity Hugo -- gohugo.io en-us 1999-2026 Rietta Inc. All Rights Reserved. Fri, 02 Oct 2026 08:57:59 -0400 What is the difference between bcrypt and SHA256? https://rietta.com/blog/bcrypt-not-sha-for-passwords/ Fri, 05 Feb 2016 10:23:27 -0500 https://rietta.com/blog/bcrypt-not-sha-for-passwords/ <p>TL;DR; SHA1, SHA256, and SHA512 are all <em>fast hashes</em> and are bad for passwords. SCRYPT and BCRYPT are both a <em>slow hash</em> and are good for passwords. Always use slow hashes, never fast hashes.</p> <p>SANS&rsquo; <a href="https://software-security.sans.org/resources/swat">Securing Web Application Technologies [SWAT] Checklist</a> is offering a bit of bad security advice for the everyday web application developer, under the heading &ldquo;Store User Passwords Using A Strong, Iterative, Salted Hash&rdquo;:</p> <blockquote> <p>User passwords must be stored using secure hashing techniques with a strong algorithm like SHA-256. Simply hashing the password a single time does not sufficiently protect the password. Use iterative hashing with a random salt to make the hash strong.</p> </blockquote>