Password systems use one-way hashes—you cannot recover the password from the hash, only verify a guess.
Good algorithms
bcrypt, scrypt, Argon2—intentionally slow to resist brute force. MD5/SHA1 alone are unsuitable for passwords.
Salt
Random salt per user prevents rainbow table attacks—store salt alongside hash.
Pseudocode
# Conceptual — use library in production
hash = argon2.hash(password + unique_salt)
verify = argon2.verify(input_password, stored_hash)Important interview questions and answers
- Q: Rainbow table?
A: Precomputed hash lookups—salt defeats tables built for unsalted hashes. - Q: Pepper?
A: Server-side secret added before hash—stored outside DB.
Self-check
- Why slow hash algorithms?
- What does salt prevent?
Tip: Argon2/bcrypt work factors should increase over years as hardware improves.
Interview prep
- Salt?
Random per-user value mixed before hash.