Is this method of salting effective?

Question

So this is my first post on this forum, so bear with me if I sound stupid. I am creating my own web application with JavaScript and MongoDB. I am storing all user information in a Mongo table, and currently this is the hashing algorithm I used to store the passwords:

function generatePassword(input) {
     return Buffer.from(crypto.createHash('sha256').update(input).digest('base32')).toString('hex').toUpperCase();
}

So, from what I recall from previous Cyber Security classes, sha256 has been long cracked, therefore deeming it insecure for storing passwords. I understand this being my web application I will not be experiencing security breaches, but I want to show that I have the awareness and knowledge to correctly and securely store the passwords. Therefore, I thought that if I changed up the code a little bit by using this:

function generatePass(input) {
     input = input + "455kjnr2902rug5348934";
     return Buffer.from(crypto.createHash('sha256').update(input).digest('base32')).toString('hex').toUpperCase();
}

I guess my questions are, is this

a. An effective salting method? If not, how would I go about salting the password? b. Is there a more secure way of doing this? Is this basically useless, or useful?

Thanks in advance to anyone who can help!

Answer 1

Sha256 has not long been cracked, but it's not useful for human-generated passwords. You want a key stretching function. SubtleCrypto provides PBKDF2 (documentation), which is fine. Other libraries might support bcrypt, scrypt, or Argon2, any of which would be better.

Salts should be unique per user. This is so that when two users have the same password, the hashes will be different. This prevents a variety of attacks, like rainbow tables or looking at the frequency of hashes. Having a constant value appended to the password doesn't make these attacks any more difficult.

Answer 2

Absolutely agree that you need unique salt per user and use a vetted algorithm such as PBKDF2, don't try to create your own no matter how simple it seems since you can easily add a iteration count to add time / complexity to an attack.