Skip to main content Scroll Top
1
By user Blogs (Demo) October 8, 2025

How do you store your users’ passwords?

1_w3pbZZaMD2X-Ne-wVtgsWg

I hope it’s not in plain text. Like Facebook did once.

You are probably salting the user’s password, hashing it, and storing the hashed value + salt somewhere safe. So even if an attacker hijacked your password store, it’s relatively hard for them to do a brute-force attack or use a precomputed dictionary of hashes ( a rainbow table ) to get the actual passwords of the users. This is pretty secure considering that you’ve used a computationally expensive hashing algorithm and were cautious not to persist the password in an unencrypted logs store, also added some password strength measures, so your users can’t use ‘dadada’ as their password like Mr Zuckerberg.

But is this the most secure way to manage the passwords of your hard-earned users? Well, there have been numerous password leaks of well-known brands with millions of users in recent history proving it isn’t.

Zero Knowledge comes to save

So what’s a more secure way? Well, security issues here arise mainly due to the server needing to access the user’s password at login. The server needs to check that user sent password is valid by hashing it and comparing it with the previously stored hash at user registration. So you need to make sure you’re handling the user-sent plain text password securely. Also, the communication between client and server should be secure as well. MITM ( man in the middle ) attacks could happen even if the server has a TLS certificate.

But does the server REALLY need to know the user’s password for authenticating? Isn’t it enough, if the server can somehow verify that the user knows the password, without explicitly asking what is his password?

Hmm, It should be enough. But can this be done? It’s like you want to prove to a bouncer at the club, that you’re not underage without showing your ID.

Well, that is possible thanks to the zero-knowledge proofs. It is an absolutely interesting cryptographic protocol in “which one party (the prover) can prove to another party (the verifier) that a given statement is true while avoiding conveying to the verifier any information beyond the mere fact of the statement’s truth”.

If you’re someone interested in the blockchain space, you’ve probably heard about this before. This has been a really hot topic with all the scaling solutions for Ethereum. However, if this is the first time you’re hearing about zero-knowledge proofs, I know this could sound completely unintuitive. So I suggest you take a look at this video to intuitively understand how zero-knowledge proofs are possible and also go beyond that.

user
user / About Author
More posts by user