Password Management
Practice this topic in a realistic system design interview
Password storage is designed for a bad day: your user database leaks.
Once an attacker has the users table, your login page is no longer in the way. The attacker can copy the password hashes and try guesses on their own machines, as fast as their hardware allows.
The goal to secure passwords is simple: make every guess slow and expensive.
Production systems should never store plaintext passwords or anything that can be decrypted back into the password. Instead, they should store salted, slow, one-way password hashes. The salt makes the same password look different for different users. The slow hash makes large-scale guessing much harder.
This chapter explains how production systems store and verify passwords without keeping the actual password.