Login Security Visualized

This interactive tool requires JavaScript. Here is a summary of the four password storage approaches:

1. Plain Hash (SHA-256)

Password → SHA-256 → stored hash. Fast, but vulnerable to rainbow tables. One cracked hash compromises everyone with the same password.

2. Salted Hash

Password + random per-user salt → SHA-256 → stored. Defeats rainbow tables and simultaneous exposure. Still fast enough for GPU brute-force.

3. Salt + Pepper

Password + salt + server-secret pepper → SHA-256. Requires attacker to breach both database AND app server simultaneously.

4. Argon2id (recommended)

Memory-hard KDF (≥ 64 MiB RAM per hash, configurable). GPU farms that crack SHA-256 at billions per second are reduced to ~2 Argon2id attempts per second. Brute-force becomes economically infeasible at that rate.

Enable JavaScript to explore each step interactively.

👤

User

⚙️

Server

🗄️

Database

🕵️

Attacker

Database

Real-world incident

Users exposed with identical password

accounts fall from a single crack

Try it — how long to crack your password?

Enter a password above

Keyboard Shortcuts

→Next step

←Previous step

1Plain Hash scenario

2With Salt scenario

3Salt + Pepper scenario

4Argon2id scenario

RReset to start

CToggle compare view

?Toggle this overlay

EscClose overlay

Press ? or Esc to dismiss

👋 Welcome to Login Security Visualized

Resume where you left off?