*(copy and pasting my answer from another thread, with minor edits)* 

> I've read that every good web application should hash passwords. I found many articles about hashing. So I started implementing hashing on my website and then I asked myself why should I do it? 


Good question, and I'm glad you asked it. I want people to find this thread when they Google it so they -- hopefully -- won't make the same mistakes that many other companies make.

You shouldn't just `hash` passwords, **[you should `salt` them][1]**, and add a [`SlowEquals`][2]. 

**Why salt?**

Let's imagine you just hash your passwords without a salt. You would end up producing a static output pretty much every single time. 

For example, "`myDarnPassword`" would end up being converted to "`aca6716b8b6e7f0afa47e283053e08d9`" in md5. At this point, you could create a dictionary attack by yourself. You could automatically generate a database that converts as many random characters, plus dictionary attacks, into a usable database. You'd create a table looks like this:

    +-------------------+----------------------------------+
    | PASSWORD          |           UNSALTED_HASH          |
    +-------------------+----------------------------------+
    | myDarnPassword    | aca6716b8b6e7f0afa47e283053e08d9 |
    +-------------------+----------------------------------+
    | pleaseDontSueMe11 | 0dd395d0ec612905bed27020fb29f8d3 |
    +-------------------+----------------------------------+

Then you would select from the database like this:

    SELECT [PASSWORD] FROM [TABLE] WHERE [UNSALTED_HASH] = 'aca6716b8b6e7f0afa47e283053e08d9'

And it would return `myDarnPassword`. 

With enough processing power and time, you could create trillions of combinations, and quite easily crack a large number of passwords. At that point, all you really have to do is look it up. And if you've stolen other people's passwords in the past from a database, you can add those, and convert them to md5 hashes.

Salting the hash defeats this attack. 

> When a user sends his or her login (name+password) to the server, the server loads the password of the given user name from database and then compares passwords. There is no way how the user could get password from the database.

Right. You compare the password to the stored hash, and if it matches the salted hash in the database, then it's considered a valid password. You may then allow the user to log in.

Below is something people can do with unhashed and unsalted plaintext passwords. It may not necessarily be used to target you directly, but let's say `Hacker` wants to target `Person A`. Let's deduce how you can target `Person A`.

1. You are `Hacker`. Your job is to hack websites and develop a database to aggregate this information.
2. `Person A` is a person of interest. `Person A` shows up in one of your hacked sites database. You now know their email address, and the `password` they're using for that website.
3. Now you can try to log in to their `email address` with `password` you've stolen from that website. Sweet, it works!
4. Now that you have access to their email, you download all of their emails through `IMAP`, or through their web-mail. At this point, you find lots of interesting things. They're communicating with `Person B`. 
5. You can actually *google* some people's usernames and email addresses, and it could show websites they post on. This will bring up other websites that the user uses. Maybe you can try to hack those websites, or maybe you can just deduce what they're into. Now you can `pretend to be like them`, or find additional information. Information/activities could include:
  - **Usernames**. `Person A` posts online as `Mark Hulkalo`. That's a relatively unique name, a combination of `Mark Ruffalo the actor`, and the monster he portrays, `The Incredible Hulk`. You can then google, `Mark Hulkalo`, and look for websites that he posts on. Maybe he reveals more of his personality on other sites? 
 - **Passwords**. Maybe `Mark Hulkalo` has the same password on that website. Maybe you can log in to that website and view his private communications with others?
 - **Personal Information**. Because you know the identity of `Mark Hulkalo`, what if he shares `personal information` on a certain website? What if he posts on `craigslist` searching for male or female escorts, and he's left his phone number there? You already found his phone information, so you can find a way to set him up and blackmail him for money/information/power. This doesn't have much to do with salting the passwords unless you don't include the phone number, but they find their phone number on another website thanks to your leak. It's one of the many very powerful ways that information can be collected and used against you. This is, after all, an **`Information Security`** forum, so I want to use this example.
 - **Family Information**. Now it's getting creepy. We've got `Mark Hulkalo`'s personal information. Let's look into his social networking. Oh, he has a `Facebook` account. Can we access this with the same password? If `Mark Hulkalo` is using the same `password/email combination`, then probably. And you can probably deduce this from his email that you accessed earlier, where you found a lot of interesting things. We can now log in and read his `Facebook` messages. Now we know who his family members are. We can then coordinate the blackmail attack more easily.
 - **Other Login Information**. Since we got access to his email earlier, we see he also has a `Skype` account. One of them is secret. We log in, and see he's flirting with his escorts on Skype. We now have more blackmail material. 
 - **Impersonation**. You can now log in and `impersonate` `Mark Hulkalo` on a variety of websites. Maybe he's actually a `straight-shooter` and never went after any escorts, or anything of the sort? Well, now you can turn him into an `escort-seeking reprobate` by using his credentials to impersonate him online. Imagine the damage that could cause to a politician who was wrongly accused and forced to resign.
 - **Things that make it easier to hack other people**. You can then send emails to `Person B` with infected attachments, and pretend you know him. You've read enough emails, so you're able to imitate `Mark Hulkalo` to the point where you seem just like him. You craft the email in a way that leaves `Person B` unsuspecting of what's really going on, and now you can do the same thing to `Person B`, or worse. 

And those are just a few scenarios. There are a lot of different uses for someone else's credentials. `Salt and hash` your `passwords`, and *prevent* `SQL injection attacks`. `Please don't turn me into an escort-seeking reprobate`! **Save Mark Hulkalo**!

*(I'm aware some websites can block your attempt to access their services when using a different IP, but there are many ways around this, and not all websites do this).*

By the way, congratulations on your class action lawsuit if you get hacked.


  [1]: https://en.wikipedia.org/wiki/Salt_%28cryptography%29
  [2]: https://stackoverflow.com/questions/21100985/why-is-the-slowequals-function-important-to-compare-hashed-passwords