How passwords and logins work: why a website should not know your password
Password hashing: how a website checks your password without keeping it
You click "forgot password" on a good website. It never sends your old password back, because it does not have it. Yet it checks every password you type. How?
-
1
Miva's website runs your password through a hash function, drawn here as a grinder. Out comes a string of letters and digits, a kind of fingerprint of your password. It is called a hash.
-
2
Put sunflower7 in a thousand times, on any computer, and the same hash comes out every time.
-
3
Change one character, and the hash has nothing in common with the first one. It gives no hint of how close you were.
-
4
And the grinder turns one way only. Nobody can feed it the hash and get sunflower7 back out.
-
5
So on the day you sign up, the website keeps only the hash. Your password itself is thrown away.
-
6
A week later, you type your password again. The website grinds it the same way and compares the two hashes. They match, so you typed the right password, and you are in. Miva never needs to know what it was.
-
7
Now the gym keeps 5,000 hashes and not one password. One night, Rono finds a way into the server and copies the whole list.
-
Quick check
Quick check.
Show the answer
No. The website keeps only the hash, and there is no way back from a hash to the password. It can only let you choose a new one.
-
Go further
One name worth knowing.