Muye Password tool

Passwords / Explainer

What is a hash?

A hash is a one-way fingerprint. The same password makes the same fingerprint when you use the same recipe, but the fingerprint is not the password.

The saved text has four parts

pbkdf2_sha256$210000$randomSalt$derivedHash

This page's generator stores the algorithm name, the number of repeats, the salt, and the final hash. Those parts are enough to test a password later, but not enough to read the original password.

1

Turn text into bytes

The password you type is changed into bytes, because hash functions work on bytes instead of letters on the screen.

2

Add a random salt

A salt is random extra data saved beside the hash. It makes two people with the same password get different stored hashes.

3

Repeat the work many times

PBKDF2 runs SHA-256 again and again. More iterations make guessing slower for attackers and still quick enough for real users.

4

Save the recipe, not the password

The site saves the recipe and result. To check a login, it repeats the same recipe with the typed password and compares the new result.

Why is it one-way?

SHA-256 mixes the input so strongly that a tiny change makes a totally different output. There is no undo button or hidden password inside the hash. The practical attack is guessing passwords and checking each guess, so salts and iterations make guessing much harder.

How verification works

  1. Read the algorithm, iterations, salt, and stored hash.
  2. Run the typed password through the same recipe.
  3. Compare the new hash with the stored hash.
  4. If they match, the password was right.