4 ms·

I don't store plaintext passwords. Nor should anyone else. Only a hash and salt.

• stan_rogers 13y ago
  Hash, salt and algorithm. That will allow you to upgrade the algorithm or work factor as your server becomes more capable (or if a deficiency in the algorithm you're using is identified), authenticate the user under the old system and re-hash on the fly, all seamlessly to the user. (If you're depending on the algorithm being a "secret sauce", you're doing it wrong.)