I understand that lots of websites store passwords in hashes but where do they actually store the hashes? How can a website compare your hashed version of a password with theirs? Is it stored somewhere in the HTML?

I understand that what a hash is and its (assumed) irreversible manner. I also understand what salting a hash is.

The thing I am confused about is how does a website store these hashes securely enough so that someone cannot just go through the html and use something like hashcat to attempt to crack them. What are the security measures in place to prevent hashes from being found? And additionally, how can I know which websites securely store their hashes?

  • Are you asking where websites store hashed passwords? It's pretty unclear what is your real question in its current form. – techraf Jun 8 '16 at 6:43
  • Password hashes are usually stored together with other user related information in a database. – martinstoeckli Jun 8 '16 at 7:03
  • My websites tend to store passwords on post-it notes on users monitors. ;-) – Little Code Jun 8 '16 at 7:29
  • A big question before this is what do you understand about HTTP? – Robert Mennell Jun 8 '16 at 22:52

Passwords are not stored by web servers, only hashes.

What happens when someone logs in is they type their password into the field. This password is sent to the server and hashed. The hash is then compared to the hash the server has stored to determine whether the password was correct or not.

Since even the server doesn't know what the password actually is (only the hash) this is much safer from a security perspective. There are some additional details which help improve the security further, such as adding a 'salt' to the password before hashing and ensuring only specific hash functions are used, however that's about the jist of it.

| improve this answer | |
  • I would add that this is possible because during the signup process the server only receives the hash of the password, so that a User | Hash database is populated, instead of a User | Password one. – A. Darwin Jun 8 '16 at 6:05
  • Sorry for the confusion. That wasn't quite what I was asking. I updated my question to better reflect what I am confused upon. – Neo Scott Jun 8 '16 at 22:05
  • 1
    You need to do a bit more research, I think. Why do you think hashes are provided in html? – Matthew Jun 9 '16 at 5:51
  • @Neo Scott As noted in my answer, the password is sent to the server and hashed there. When a server sends a HTML page to the client, it has no reason to embed any hashes into the page itself. You seem to have a misunderstanding that the page you view is the entirety of a web service when that is not the case. Most functional code is never sent to the client's browser, rather the client sends requests for actions to the server using a webpage as a thin GUI. – Numeron Jun 9 '16 at 6:42

Not the answer you're looking for? Browse other questions tagged or ask your own question.