What is password hashing?
Password hashing means storing passwords in a scrambled form that cannot be turned back into the original. When someone logs in, the app scrambles what they typed and compares the results. If your database leaks, the attackers get scrambled values, not working passwords.
ON THIS PAGE
What it means
A hash is a one-way scramble. 'hunter2' always becomes the same long string, but you cannot work backwards from the string to the word.
Good password hashing is also deliberately slow, and adds a random value called a salt to each password. That makes guessing millions of passwords per second impractical.
Why it matters for vibe-coded apps
If you build your own login, the quickest thing to write is to save the password as typed. If you use a managed login service, this is done for you.
- A database leak exposes every user's real password.
- People reuse passwords, so a leak from your app puts their other accounts at risk.
- Fast hashes such as MD5 or plain SHA-256 can be cracked quickly.
Example
A sign-up and login you wrote yourself.
await db.users.insert({ email, password: req.body.password });import bcrypt from "bcrypt";
const hash = await bcrypt.hash(req.body.password, 12);
await db.users.insert({ email, password_hash: hash });
// At login
const ok = await bcrypt.compare(req.body.password, user.password_hash);Argon2 is another strong choice. Never use MD5 or SHA-1 for passwords.
How to check if your app has this problem
- 1Open your users table. If you can read the passwords, they are not hashed.
- 2Hashed values look like long random text, often starting with $2b$ (bcrypt) or $argon2.
- 3Search your code for md5, sha1 and createHash used on passwords.
The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.
Run a free scan →How to fix it
- 1Use a managed login service, such as Supabase Auth or Firebase Auth, if you can.
- 2Otherwise hash with bcrypt or Argon2, never with a plain fast hash.
- 3Make existing users reset their passwords, or re-hash each one the next time they log in.
- 4Never log passwords or send them in emails.
Check how my project stores user passwords. If any are stored as plain text or with MD5 or SHA, change sign-up and login to use bcrypt (cost 12) or Argon2, add a password_hash column, and re-hash existing users when they next log in. Make sure passwords are never logged. Don't change anything else.
Check if your app has this problem
Paste your website and we'll check for password hashing issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.
Last updated
Related terms
- Two-factor authentication (2FA)A second step at login, like a code from your phone.
- Rate limitingA cap on how many requests someone can make in a set time.
- Authentication vs authorizationChecking who someone is, versus checking what they're allowed to do.
- SQL injectionAn attacker types database commands into your app and it runs them.
Need help?
Not sure what this means for your app? Our team will explain it in plain English.