When you create an account on a website, the website should not actually store your password! But how can they say “we don’t store your password” while still being able to verify your password?

With a little bit of math, we can do two things to your password that make it possible to store a “signature” of your password without storing the password itself.

Hashing: a one-way function

You can think of a hashing function like a digital recipe.

If you mix flour, eggs, and sugar, you could make a cake. But, even if you have a cake, you can’t magically turn it back into flour, eggs, and sugar. Essentially, the process of cake-making can’t be reversed.

When you create a password, the website runs what you type in through a hashing algorithm. Hashing algorithms, like making a cake, are special in that they are one-way functions. You can easily hash a password, but you can’t reverse the hash back into a password.

Hashing scrambles your password into a long, random string of characters that looks like this:

• denison ➡️ f8daffab459eb267617a27f3ed1dfba9835f2e6ba4adbeb94b04c309f6cf1e70
• Denison ➡️ ecc7a99247d4a03061ab54cc46095275ea28fbf138c9147d65769781c4345dc4
• bigred! ➡️ d0680bc7dfa9755fb48f01125f29b391aae46b13ca7d91b4e54399ab35fa4260
• BigRed! ➡️ a9d22672e44d17de00f2e0821d6305451d04370d1f3cf9e91f4e6f5f22b13222

The hash is what is stored in the database. So, even if a hacker manages to breach the database, they only see a bunch of gibberish, not your actual password.

The clever part of a hashing algorithm is that changing just a little bit of the input completely changes the output. Notice how capitalizing just the “D” in “Denison” changed not just the first part of the hash but the entire hash.

So, when you log into a website, here’s what actually happens, behind the scenes:

1. You type in your username and password.
2. Your browser hashes the password using the same hashing algorithm that was used when the password was originally created.
3. The hash is sent to the server, where it is compared with the hash stored in the database.
   • If the hashes match, then the same password must’ve been entered that was stored.
   • If the hashes don’t match, the passwords must’ve been different, so you get returned to the login page.

Salting: seasoning the hash with some special sauce

The beauty of a hashing algorithm is that it produces the same hash (output) for a given input (your password). The input denison will always be hashed to f8daffab459eb267617a27f3ed1dfba9835f2e6ba4adbeb94b04c309f6cf1e70.

But, let’s imagine that two people (Abby and Steve) magically picked the same password, denison. What would be stored in the database?

Well, Abby’s and Steve’s password hashes would be identical! Both would be f8daffab459eb267617a27f3ed1dfba9835f2e6ba4adbeb94b04c309f6cf1e70. If Steve got phished and revealed their password, then Abby’s accounts are also at risk, which isn’t good!

To prevent this, we also salt passwords. In our cake analogy, think of this as a secret ingredient to make your cake extra delicious. Abby might add vanilla extract, while Steve chooses to add butter. In the password world, we add some extra component to the password before it’s hashed. For a simple example, we can just put their username at the beginning of their password.

So, Abby’s password would change from denison to winston_a_denison, and Steve’s password would change from denison to levitt_s_denison. Recalling what we know about hashing algorithms and how they completely change, even if only one component of the input changes, we end up with completely different hashes.

• denison (the old password) ➡️ f8daffab459eb267617a27f3ed1dfba9835f2e6ba4adbeb94b04c309f6cf1e70
• winston_a_denison (Abby’s salted password) ➡️ 42c7ade3278e9c6523e103dc5d6a9ce9b3048f03724054d0733bbf1ec6ef747a
• levitt_s_denison (Steve’s salted password) ➡️ 539df8919bd78c47808d6ccce35bab329ab7c81cefcbe386507c31eabc5e27d8

Why does this matter?

That’s the beauty of these two techniques: they’re invisible processes, easy to implement, and virtually impossible to break! In these examples, we used SHA256, the same hashing algorithm used by web browsers to secure the connection. (See that padlock in the address bar? Look for the signature algorithm!)

Don’t worry: Denison hashes and salts your passwords!