Authentication interview question · Most asked
How should passwords be stored?
Summary
Never store plaintext or reversible encryption; store a slow, salted, adaptive hash using Argon2id (preferred), scrypt or bcrypt, and verify with the library's constant-time comparison. Rehash when you raise cost parameters.
Longer Answer
Fast hashes (MD5, SHA-256) allow billions of guesses per second on GPUs; password hashing algorithms are deliberately slow and memory-hard. Salts (handled by the library) defeat rainbow tables; an optional server-side pepper adds protection if only the DB leaks. Also: rate-limit login, check passwords against breached-password lists (HIBP k-anonymity API), and follow NIST guidance (length over complexity rules, no forced periodic rotation).
Key Points
- Argon2id / scrypt / bcrypt
- Unique salt per password
- Constant-time verify
- Breached-password checks
- Rate-limit logins
More most-asked Authentication questions
- What is the difference between authentication and authorization?
- Compare session-based authentication with token-based (JWT) authentication.
- What are the most common JWT security pitfalls?
- What are OAuth 2.0 and OpenID Connect, and how do they differ?
- Explain the OAuth 2.0 Authorization Code flow with PKCE.
- How do refresh tokens work, and how do you secure them?
- What is multi-factor authentication, and which factors are strongest?
- How do you secure session cookies?