Think Positive Cyber

SHA transforms a password into a fixed-length digital fingerprint called a hash. The original password should not be stored in readable form, and the hash is designed to be difficult to reverse. However, SHA by itself is not enough because attackers can rapidly test common passwords and compare the resulting hashes.

Password Salting strengthens protection by adding a unique random value to each password before hashing it. Even when two people choose the same password, their stored results should look different because each account uses a different salt. This makes large collections of precomputed guesses much less effective and forces an attacker to work on each password separately.

PBKDF2 makes password guessing slower by repeatedly processing the password, salt, and hash many times. The extra work is barely noticeable during a normal sign-in, but it becomes costly when someone tries millions of guesses. HMAC uses a secret key with a hash function to confirm that information came from a trusted source and was not changed, so SHA, HMAC, Password Salting, and PBKDF2 each provide a different layer of digital protection.