Passwords are hashed, not encrypted.

What Happens to Your Password?

Follow a password through signup and login. A responsible service stores a unique salt and a one-way derived hash, then verifies future attempts by running the same computation again.

stored_hash = PBKDF2(password, salt, cost)
login = compare(stored_hash, new_hash)

Password Lab

Your input stays in this page. The hash is computed with Web Crypto in your browser.

Measuring 0 guesses
Length 0
Character Pool 0
PBKDF2 Cost 100,000
Demo Guess Budget 0

Avalanche Effect

Change one character and the output becomes unrelated.

Current password

One-character change

One-Way Pipeline

Easy to compute forward. Hard to reverse except by guessing.

Password

The secret goes into the function. A login system can check it later without storing the original text.

Salt + Cost

The salt makes equal passwords store differently. The cost makes every guess slower.

Stored Hash

This is safe to store because it does not contain a reversible copy of the password.

Stolen Database Attack

The attacker steals the stored record, then tests password guesses against it.

Ready

Run the attacker to test common passwords and simple variants. Strong secrets survive this tiny demo budget because the only route back is guessing.

Salt
Cost
Hash

What the stolen record may reveal:

The PBKDF2-HMAC-SHA-256 recipe and cost.
The unique salt stored with the hash.
The derived hash, but not the original password.