How passwords are stored: never as text, always hashed with a unique salt, so even we cannot read them and a stolen database is worthless.
A password is never stored. What is stored is the result of running it through a slow one-way function together with a random value unique to that account — the salt. Checking a login means running the same process again and comparing results.
If a database ever leaked, the passwords in it would still be useless. The salt means two people with the same password have completely different records, so an attacker cannot crack them in bulk with a ready-made table, and the deliberately slow function makes guessing them one by one impractical.
It also means nobody inside your company — or ours — can read a customer's password. A forgotten password is reset, never looked up.
AngularFront-end
TypeScriptTooling
Node.jsBack-end
PostgreSQLDatabase
SequelizeBack-end
JWTSecurity
SMTPIntegrations
Helmet.jsSecurityTell us what your business needs. We'll build the system around it.
START A CONVERSATION →or email us at info@nilexdigitalsystems.com
