---
title: "Store passwords with a slow hash · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/password-storage
updated: 2026-10-20
licence: "All rights reserved"
---

# Store passwords with a slow hash

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Access and accounts](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts)
- Rule: Store passwords only as a slow, salted hash made for passwords, such as Argon2id or bcrypt.
- How: Use a maintained password hashing library. OWASP suggests Argon2id with 19 MiB of memory, 2 passes and 1 thread as a minimum. Use scrypt, or PBKDF2 with 600,000 rounds of HMAC-SHA-256 where FIPS rules apply. Use bcrypt with a cost of at least 10 only for older systems, because it reads only the first 72 bytes. Never use a fast hash such as SHA-256 alone. Rehash old hashes when a user next logs in.
- Check: Look at a test user's row in the database. The password field starts with a marker such as `$argon2id$`, `$scrypt$` or `$2b$`, never the password or a plain hex hash.

Example:

```js
// Node with the argon2 package: Argon2id is the default
import argon2 from 'argon2';
const hash = await argon2.hash(password);
const ok = await argon2.verify(hash, attempt);
```

```python
# Python with argon2-cffi: Argon2id is the default
from argon2 import PasswordHasher
hasher = PasswordHasher()
hash_ = hasher.hash(password)
hasher.verify(hash_, attempt)  # raises VerifyMismatchError when wrong
if hasher.check_needs_rehash(hash_):
    hash_ = hasher.hash(attempt)
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/password-storage`.

- Previous: [Slow down password guessing](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/login-guessing)
- Next: [Lock down session cookies](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/session-cookies)
- [Access and accounts](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts)