Agent WranglersAccess and accounts Required
Store passwords with a slow hash
Store passwords only as a slow, salted hash made for passwords, such as Argon2id or bcrypt.
How to do it
Use your platform's password hashing library. OWASP suggests Argon2id with 19 MiB of memory, 2 passes and 1 thread as a minimum. Use bcrypt with a cost of at least 10 only for older systems, because it reads only the first 72 bytes. Never use a fast hash such as SHA-256 alone. Rehash old hashes when a user next logs in.
How to check
Look at a test user's row in the database. The password field starts with a marker such as $argon2id$ or $2b$, never the password or a plain hex hash.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/password-storage.