What is the difference between bcrypt and SHA256?

Fri, 05 Feb 2016 10:23:27 -0500

TL;DR; SHA1, SHA256, and SHA512 are all fast hashes and are bad for passwords. SCRYPT and BCRYPT are both a slow hash and are good for passwords. Always use slow hashes, never fast hashes.

SANS’ Securing Web Application Technologies [SWAT] Checklist is offering a bit of bad security advice for the everyday web application developer, under the heading “Store User Passwords Using A Strong, Iterative, Salted Hash”:

User passwords must be stored using secure hashing techniques with a strong algorithm like SHA-256. Simply hashing the password a single time does not sufficiently protect the password. Use iterative hashing with a random salt to make the hash strong.

Really Bad Passwords (with Unsalted Hashes)

Fri, 08 Jun 2012 18:30:00 +0000

The June, 2012, LinkedIn password breach reminds us all the need to protect our user’s passwords. The following table includes a series of really, really bad passwords. These are passwords that are trivially cracked using an automated tool, such as John the Ripper, or have been found through public password hacks as being in use by real people. This is a simple rainbow table because it lists the precomputed unsalted SHA1 and MD5 hashes.

Salt (Password Hashing) on Rietta Cybersecurity

What is the difference between bcrypt and SHA256?

Really Bad Passwords (with Unsalted Hashes)