Member Avatar for Traps

I'm making a website and of course want to incorporate memberships and logins, etc and while I understand the theoretical application of salting and hashing a user-inputted password to save the encrypted pass in my database, I'm not sure on the approach...

What I would do is get the hashCode of the string/password and then salt it BUT that won't work as the hashCode will never be the same so it would be impossible to compare them...

So how would you actually hash a password? Have I got it all wrong and by hashing a password you don't actually mean getting the hashcode?

  • 2 Contributors
  • 2 Replies
  • 131 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by Traps

Dani AI

Generated

A few practical notes that expand on what and touched on.

Do not use Object.hashCode() or String.hashCode() for passwords. They are not cryptographic hashes. Use a slow, adaptive password-hashing algorithm (Argon2 is the current PHC winner; bcrypt is widely supported; PBKDF2 is acceptable) with a unique, cryptographically-random salt per user. Store the algorithm identifier and parameters (cost/iterations/memory) with the hash so you can increase work factors later; OWASP has a concise checklist on this: OWASP Password Storage Cheat Sheet.

Use a well-tested library rather than implementing primitives yourself. For bcrypt in Java, jBCrypt or Spring Security’s encoder are simple to integrate. Example (jBCrypt):

String hashed = BCrypt.hashpw(plainPassword, BCrypt.gensalt(12));
boolean ok = BCrypt.checkpw(candidatePassword, hashed);

If you use PBKDF2 with the JCE, prefer an HMAC-SHA2 variant and a high, configurable iteration count; always use SecureRandom for salt and encode salt+params+hash together for storage. The JDK SecretKeyFactory + PBEKeySpec can be used for this.

Operational tips: pick a cost that makes verification moderately slow (tunable), re-hash passwords on successful login when you increase cost or change algorithms, enforce rate limiting/lockouts and monitoring for brute-force attempts, and add multi-factor authentication where possible. When choosing Argon2/bcrypt/PBKDF2 libraries, pick maintained projects and check their documentation; the Argon2 reference is here: PHC Argon2 on GitHub.

These practices protect you from common mistakes and make future migration straightforward.

Recommended Answers

All 2 Replies

Member Avatar for NormR1

How are you going to use a java program for this project?

There are many algorithms for hashing a String. Have you researched one that looks good for you?
By hashCode are you referring to what is returned by the Object class's hashCode() method?

Member Avatar for Traps

I've already found a working solution so I'll mark this as solved, but to answer your question:

I'm making a Web App and want to store users (usernames and passwords) in my database to handle user/login-sessions but don't want to store the passes as clear text.

Yes, by hashCode I am referring to the Object.hashCode() method

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.