I am posting this question here for the procedures(If any) of making my own password hashing technique. Because bad encryption makes the severe damages as far I learned


closed as too broad by otus, Maarten Bodewes, tylo, D.W., e-sushi Aug 19 '16 at 20:35

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • $\begingroup$ As far as you learnt where? what references do you have to back your argument? $\endgroup$ – Bush Aug 17 '16 at 19:24
  • $\begingroup$ For the purposes of self-education, or because you actually want to use this in a product or real-world environment? $\endgroup$ – Stephen Touset Aug 17 '16 at 19:51
  • 1
    $\begingroup$ Study existing schemes. I'd look at PBKDF1, bcrypt and Argon2. (scrypt and PBKDF2 are needlessly complicated, so they're not ideal for learning). $\endgroup$ – CodesInChaos Aug 17 '16 at 20:33
  • 1
    $\begingroup$ Shame, you "just" missed the SHA-3 and password hashing competitions :) Seriously, first look up a few of the hashing schemes that didn't make it to the final round and study why they didn't. Then try and see if an existing implementation is vulnerable or not. If you can do that then it's time to define your own. $\endgroup$ – Maarten Bodewes Aug 17 '16 at 22:02

First step is to learn that hashing is not encryption. That's password hashing, not password encryption (unless you are doing something weird or special).

Then I would suggest first reading up on existing password hashing theory and practice, starting for instance there. Next step would be to go through the archives of the Password Hashing Competition, a process through which various practitioners of cryptography submitted their own designs for password hashing, for a total of 24 submissions. They then discussed them at length (unfortunately, the archive was on Gmane and Gmane shut down a few weeks ago; I'll try to bug the PHC people to see if an alternative can be set up).

So while the normal process for designing a new cryptographic primitive can be expressed as "don't do that" with a side plate of "don't do that EVER you dummy", you might still want to at least get an idea of how such things do get done, when they get done. The first step of any scientific endeavour is always to read up on everything that was already done about the subject at hand, and cryptography is no exception. So these submissions to PHC should serve as the baseline for the process of creating a new password hashing function; read all of them, to get some intuition of what exactly is needed and how it may be provided when hashing passwords.



If you want to avoid bad encryption, then rule #1 is to not make your own encryption but use something that has been made by more knowledgeable people and well tested 'in the field'.

The best practice way for hashing passwords would be to use some well-known module in the framework that you're going to use for your system that supports proper storage of hashed passwords and handles other tricky items surrounding the actual hashing that are just as likely to create vulnerabilities - if you add specific details, you'll get specific suggestions.

If you're not going to do that, then you should use some well-known library that handles the actual hashing part - e.g. bcrypt with salt could be an option. But that already requires experience to do it properly. https://crackstation.net/hashing-security.htm is one of many places with suggestions on that.

If you want to code your own implementation, you might code one of well known algorithms for fun and practice. Naturally, you should not ever ever use this implementation for any real world encryption. Any other implementation will have less vulnerabilities than yours. This implementation will be "bad encryption makes the severe damages as far I learned"

If you want to develop your own hashing algorithm for fun and practice, again, you can read up on existing secure and nonsecure hashing algorithms and implement something - but again, you shouldn't use it anywhere in practice because this will be bad encryption.


Not the answer you're looking for? Browse other questions tagged or ask your own question.