HN user

xblau

9 karma
Posts0
Comments5
View on HN
No posts found.

Why isn’t SHA256 good as a password hash?

Because it wasn't designed for it. For password hashing you want a hash that has a salt (so that the same password on two accounts doesn't have the same hash on the database) and is as slow as possible (that is, fast enough to validate on logins) to increase brute-force time.

Historically Bcrypt was a good option, but I think Argon2[0] is the current best option.

[0] https://en.wikipedia.org/wiki/Argon2