Passwords and hashing: why a good app can't tell you your own password

Ask any well-built app to email you your current password. It can't. Here's why.

It doesn't store your password. It stores a hash: a one-way scramble it can check against but never turn back into the original.

The rule is blunt. OWASP: "Passwords should never be stored in plain text. Instead, they must be protected using strong, slow hashing algorithms such as Argon2id, bcrypt, or PBKDF2."

So how does login work if the password is gone? The app hashes what you type and compares it to the stored hash. The same input always gives the same hash, so a match means the password was right, without the app ever keeping it.

The salt stops shortcuts. OWASP: "A salt is a unique, randomly generated string that is added to each password as part of the hashing process." Because each user's salt differs, two people with the same password get different hashes, and precomputed "rainbow table" lookups don't work.

And slowness is the point. OWASP notes "fast hashing algorithms such as SHA‑256 are not suitable for password storage" because they let an attacker guess billions of times quickly; argon2 and bcrypt are deliberately slow.

Try it with the rules off. In the sandbox, change one character of a password and watch the whole hash change beyond recognition. Then try to run the hash backwards to the password. You can't; nor can anyone else.

Next in who are you: Sessions and tokens.