How your Password is stored into Website's database and How Can You Avoid Having Your Password Leaked

There are many ways a site can store your Password in database. Some of them are secure than others.We are going to discuss them .

Method 1:Plain text passwords

The simplest way a site can store your password is plain text. That means somewhere in their database your credentials are stored in the same way you you use them to get access (In human readable form) .Such as  if your password is Admin123 it will be stored  as Admin123. When you want to access the website and enter your credentials it will match your credentials with database.

 But if someone hack into this database he can easily access your credentials.

Does The Strength of Password matters? 

NO, No matter how long and strong your password is ,If it is stored in plain text form and someone hacked into the database your password is easily accessible.

Method 2:Basic Password Encryption

To add protection to your password than plain text provides, most sites encrypt your password before they store in their database. Encryption. If a hacker get your encrypted password, he wouldn’t be able to log into your account unless he also had the key which can be used to decrypt .

But the negative side is  the keys are often stored on the same server where passwords are stored.if a server get hacked hacker doesn't have to do much work to decrypt your credentials.

Does The Strength of Password matters? 

No. Since it’s easy to decrypt the password database with a key, your strong password won’t make a difference here either

Method 3:Hashed Passwords

Hashing is similar  to encryption because it also  turns your password into a long string of letters and numbers to keep it hidden. However, unlike encryption, hashing is a one way street: If you have the hash, you can’t run the algorithm backwards to get the original password. This means a hacker would have to obtain the hashes and then try a number of different password combinations to see which ones worked.

The dark side of  this method is: While a hacker can’t decode a hash back to the original password, they can try many different passwords until one matches the hash they have. Computers can do this very fast, and with the help of  rainbow tables which is essentially a list of trillions of different hashes and their matching passwords .they can just look up the hash to see if it’s already been discovered.They can search the hashes on internet to check if it has already being discovered.

Does The strength of my password matters?

Yes. Rainbow tables are made up of passwords that have already been tested against hashes, which means the really weak ones will be cracked very quickly. Their biggest weakness, however, isn’t complexity, but length. You’re better off using a very long password  rather than a short, complex one.

Method 4:Hashed+Salted Passwords

Salting a hash means adding some random string to it called  SALT.It uses a different salt for each password, and even if the salts are stored on the same servers, it will make it very hard to find those salted hashes in the rainbow tables, since each one is long, complex, and unique.

Does The strength of my password matters?

The computers of today are very fast and can brute-force even salted hashes .it can take take a long time certainly longer than rainbow tables. This means the strength of your password matters. The longer and complex it is ,The longer it will take time to be cracked.

Method 5:Slow Hashes 

most security experts are pointing to slower hashes as the best option for storing passwords. Hash functions like MD5, SHA-1, and SHA-256 are relatively fast: if you type in a password, it will return the results fairly quickly. In a brute force attack, time is the most important factor. By using slow hashes it will take more time to crack .

Does The strength of my password matters?

Yes, since strong passwords are harder to brute force, a strong password can definitely help you. If your password is strong, it could take a  very long time to crack with a slow hash.

How Can You Avoid Having Your Password Leaked?

• Use strong Passwords (Long,complex, use special characters ,numbers etc)
• Change Your Passwords Periodically (E.g after 2 or 3 months)
• Use Different password for different services and websites (E.g use different passwords for Facebook and twitter etc)
• Don't use services with less security(E.g website storing data in plain text)