Useful password hashing
Markus Dürmuth · 2013
Password-based authentication is widely used today, despite problems with security and usability. To control the negative effects of some of these problems, best practice mandates that servers do not store passwords in clear, but password hashes are used. Password hashes slow down the password verification and thus the rate of password guessing in the event of a server compromise. A slower password hash is more secure, as the attacker needs more resources to test password guesses, but at the same time it slows down password verification for the legitimate server. This puts a practical limit on the hardness of the password hash and thus the security of password storage.