Most auth libraries protect users' passwords without showing you what's happening behind the scenes. In this tutorial, @b_eautifulchaos explains how password hashing and salting work, why plain hashes aren't enough, and why bcrypt is designed to be slow.
www.freecodecamp.org/news/passwor...
www.freecodecamp.org/news/passwor...
November 7, 2026 at 9:01 PM
Most auth libraries protect users' passwords without showing you what's happening behind the scenes. In this tutorial, @b_eautifulchaos explains how password hashing and salting work, why plain hashes aren't enough, and why bcrypt is designed to be slow.
www.freecodecamp.org/news/passwor...
www.freecodecamp.org/news/passwor...
Your login API is getting 50,000 requests every minute.
They come from 30,000 different IP addresses.
Almost every one fails. Wrong password, every time. The senders are bots.
#Cybersecurity #Programming #Authenticating #BackendDevelopment
pixicstudio.medium.com/tls-fingerpr...
They come from 30,000 different IP addresses.
Almost every one fails. Wrong password, every time. The senders are bots.
#Cybersecurity #Programming #Authenticating #BackendDevelopment
pixicstudio.medium.com/tls-fingerpr...
How a TLS Fingerprint Can Reject a Bot Before bcrypt Ever Runs.
50,000 Failed Logins a Minute. Nobody Got In. Your App Is Still Down.
pixicstudio.medium.com
November 7, 2026 at 7:27 AM
Your login API is getting 50,000 requests every minute.
They come from 30,000 different IP addresses.
Almost every one fails. Wrong password, every time. The senders are bots.
#Cybersecurity #Programming #Authenticating #BackendDevelopment
pixicstudio.medium.com/tls-fingerpr...
They come from 30,000 different IP addresses.
Almost every one fails. Wrong password, every time. The senders are bots.
#Cybersecurity #Programming #Authenticating #BackendDevelopment
pixicstudio.medium.com/tls-fingerpr...
bcrypt only reads the first 72 bytes of a password, and now two RFCs fix it. Andrey Andreev's PASSWORD_BCRYPT_WRAP hashes the password first, with cSHAKE256 or HMAC-SHA512, then runs bcrypt. Kamil Tekiela raised hash shucking; Andrey disagreed and added pseudo-code for @timwolla.bsky.social.
November 5, 2026 at 9:58 PM
bcrypt only reads the first 72 bytes of a password, and now two RFCs fix it. Andrey Andreev's PASSWORD_BCRYPT_WRAP hashes the password first, with cSHAKE256 or HMAC-SHA512, then runs bcrypt. Kamil Tekiela raised hash shucking; Andrey disagreed and added pseudo-code for @timwolla.bsky.social.
「パスワードはハッシュ化されれば元のパスワードは参照できないので安全」という時代はおわっていた。MD5が弱いのは知っていたが、SHA-256やbcryptでもGPU演算だと比較的容易に解けてしまう。いまウェブアプリを作るなら、Argon2idを使うのが定石のようだ。これはハッシュをとくためには莫大なメモリを要求する仕掛けになっているそうだ。
November 3, 2026 at 10:24 PM
「パスワードはハッシュ化されれば元のパスワードは参照できないので安全」という時代はおわっていた。MD5が弱いのは知っていたが、SHA-256やbcryptでもGPU演算だと比較的容易に解けてしまう。いまウェブアプリを作るなら、Argon2idを使うのが定石のようだ。これはハッシュをとくためには莫大なメモリを要求する仕掛けになっているそうだ。
Storing passwords with MD5 in 2026 is inexcusable. Use argon2, bcrypt, or scrypt - in that order of preference. #infosec #dev
November 4, 2026 at 9:22 AM
Storing passwords with MD5 in 2026 is inexcusable. Use argon2, bcrypt, or scrypt - in that order of preference. #infosec #dev
bcryptでもそうなんだ。 >RP
これSpring Securityのデフォルトのパスワードエンコーダーじゃなかったかな。Spring SecurityではArgon2も選べるね。
これSpring Securityのデフォルトのパスワードエンコーダーじゃなかったかな。Spring SecurityではArgon2も選べるね。
November 4, 2026 at 1:40 AM
bcryptでもそうなんだ。 >RP
これSpring Securityのデフォルトのパスワードエンコーダーじゃなかったかな。Spring SecurityではArgon2も選べるね。
これSpring Securityのデフォルトのパスワードエンコーダーじゃなかったかな。Spring SecurityではArgon2も選べるね。
Rotate Graylog admin password via REST API PUT /api/users/admin, bcrypt-hashed to MongoDB, then persist to Vault. #graylog #vault #credentials https://www.valtersit.com/vault/rotate-graylog-admin-password-via-rest-api-and-persist-to-va-9cb000/
Rotate Graylog Admin Password via REST API and Persist to Vault
www.valtersit.com
November 1, 2026 at 11:00 AM
Rotate Graylog admin password via REST API PUT /api/users/admin, bcrypt-hashed to MongoDB, then persist to Vault. #graylog #vault #credentials https://www.valtersit.com/vault/rotate-graylog-admin-password-via-rest-api-and-persist-to-va-9cb000/
Bcrypt Hash Generator & Verifier Online
Generate secure bcrypt password hashes and verify hashes client-side. Set cost rounds (4-14) with zero server transmission.
Free: https://allmytools.tech/tools/bcrypt-generator #dev
Generate secure bcrypt password hashes and verify hashes client-side. Set cost rounds (4-14) with zero server transmission.
Free: https://allmytools.tech/tools/bcrypt-generator #dev
October 28, 2026 at 8:20 AM
Bcrypt Hash Generator & Verifier Online
Generate secure bcrypt password hashes and verify hashes client-side. Set cost rounds (4-14) with zero server transmission.
Free: https://allmytools.tech/tools/bcrypt-generator #dev
Generate secure bcrypt password hashes and verify hashes client-side. Set cost rounds (4-14) with zero server transmission.
Free: https://allmytools.tech/tools/bcrypt-generator #dev
Для PHP 8.7 уже голосують за винятки в hexdec() і base_convert() та обговорюють коментарі в JSON, ext/csv, array_partition() і Scope. https://laravelukraine.com/blog/php-87-iaki-rfc-obgovoriuiut-u-zovtni-i-za-shho-vze-golosuiut?utm_source=bluesky #PHP
PHP 8.7: огляд жовтневих RFC
Що пропонують для PHP 8.7: винятки в hexdec(), енуми для ext/filter, коментарі в json_decode(), ext/csv, array_partition(), bcrypt-sha256 і Scope. Стан голосува...
laravelukraine.com
October 29, 2026 at 9:36 AM
Для PHP 8.7 уже голосують за винятки в hexdec() і base_convert() та обговорюють коментарі в JSON, ext/csv, array_partition() і Scope. https://laravelukraine.com/blog/php-87-iaki-rfc-obgovoriuiut-u-zovtni-i-za-shho-vze-golosuiut?utm_source=bluesky #PHP
RT @hashcat@x.com
hashcat v8.0.0 released!
The largest update in the history of hashcat, with PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards.
Release notes: github.com/hashcat/hash...
Download: hashcat.net/hashcat/
hashcat v8.0.0 released!
The largest update in the history of hashcat, with PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards.
Release notes: github.com/hashcat/hash...
Download: hashcat.net/hashcat/
hashcat/docs/releases_notes_v8.0.0.md at v8.0.0 · hashcat/hashcat
World's fastest and most advanced password recovery utility - hashcat/hashcat
github.com
October 25, 2026 at 11:14 PM
RT @hashcat@x.com
hashcat v8.0.0 released!
The largest update in the history of hashcat, with PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards.
Release notes: github.com/hashcat/hash...
Download: hashcat.net/hashcat/
hashcat v8.0.0 released!
The largest update in the history of hashcat, with PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards.
Release notes: github.com/hashcat/hash...
Download: hashcat.net/hashcat/
hashcat 8.0.0 has been released!
> This is the largest update in the history of hashcat. It brings PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards, along with 146 new hash-modes and 306 bug fixes.
If you are upgrading an existing setup, please read […]
> This is the largest update in the history of hashcat. It brings PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards, along with 146 new hash-modes and 306 bug fixes.
If you are upgrading an existing setup, please read […]
Original post on infosec.exchange
infosec.exchange
October 25, 2026 at 10:57 PM
hashcat 8.0.0 has been released!
> This is the largest update in the history of hashcat. It brings PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards, along with 146 new hash-modes and 306 bug fixes.
If you are upgrading an existing setup, please read […]
> This is the largest update in the history of hashcat. It brings PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards, along with 146 new hash-modes and 306 bug fixes.
If you are upgrading an existing setup, please read […]
🔑 Làm web/app mà lưu mật khẩu dạng text là toang! Băm mật khẩu chuẩn Bcrypt chỉ trong 1 click — miễn phí, chạy ngay trên trình duyệt.
👉 congcuviet.com/cong-cu/bam-...
#congcuviet #bcrypt #baomat
👉 congcuviet.com/cong-cu/bam-...
#congcuviet #bcrypt #baomat
October 24, 2026 at 5:50 AM
🔑 Làm web/app mà lưu mật khẩu dạng text là toang! Băm mật khẩu chuẩn Bcrypt chỉ trong 1 click — miễn phí, chạy ngay trên trình duyệt.
👉 congcuviet.com/cong-cu/bam-...
#congcuviet #bcrypt #baomat
👉 congcuviet.com/cong-cu/bam-...
#congcuviet #bcrypt #baomat
ハッカーがハッシュ化されたパスワードを総当たりで解析するのにかかる時間⏳️
・ハードウェア：RTX5090✖️16
・ハッシュ関数：bcrypt(10)
結論：パスワードはランダムで、できるだけ長くしよう。
(RTX5090 16台を購入しようとするとNVIDIAの希望小売価格でも630万円かかるけど😵️💫️)
・ハードウェア：RTX5090✖️16
・ハッシュ関数：bcrypt(10)
結論：パスワードはランダムで、できるだけ長くしよう。
(RTX5090 16台を購入しようとするとNVIDIAの希望小売価格でも630万円かかるけど😵️💫️)
October 23, 2026 at 8:54 AM
ハッカーがハッシュ化されたパスワードを総当たりで解析するのにかかる時間⏳️
・ハードウェア：RTX5090✖️16
・ハッシュ関数：bcrypt(10)
結論：パスワードはランダムで、できるだけ長くしよう。
(RTX5090 16台を購入しようとするとNVIDIAの希望小売価格でも630万円かかるけど😵️💫️)
・ハードウェア：RTX5090✖️16
・ハッシュ関数：bcrypt(10)
結論：パスワードはランダムで、できるだけ長くしよう。
(RTX5090 16台を購入しようとするとNVIDIAの希望小売価格でも630万円かかるけど😵️💫️)
Win32_Hash — Password hashing and verification library for Windows, written in Ada/SPARK using the Windows CNG API (bcrypt) and proved with GNATprove. https://ktp.sh/1x4gvm9lZG
October 21, 2026 at 6:07 AM
Win32_Hash — Password hashing and verification library for Windows, written in Ada/SPARK using the Windows CNG API (bcrypt) and proved with GNATprove. https://ktp.sh/1x4gvm9lZG
Quick summary of technical security architecture- hashing mechanisms, password storage, and AUTH_KEY generation across all our Next.js and Go services.
Read full on Subtack:
contrarianreader.substack.com/p/explained-...
#openssl #hashkey #oauth #security #golang #nextjs
Read full on Subtack:
contrarianreader.substack.com/p/explained-...
#openssl #hashkey #oauth #security #golang #nextjs
Explained: Hashing, Bcrypt, and OpenSSL Auth Keys
Quick summary of technical security architecture regarding hashing mechanisms, password storage, and AUTH_KEY generation across our Next.js and Go services.
contrarianreader.substack.com
October 22, 2026 at 12:02 AM
Authelia reads users from a file but still requires a storage provider, SQLite at least. Dex doesn't: storage type memory, staticPasswords with bcrypt hashes, one YAML you can keep in SOPS. I ran Dex 2.47 in Docker and got an id_token from a password grant, at 10 MB of RAM. Restarts drop sessions.
October 21, 2026 at 3:21 PM
Authelia reads users from a file but still requires a storage provider, SQLite at least. Dex doesn't: storage type memory, staticPasswords with bcrypt hashes, one YAML you can keep in SOPS. I ran Dex 2.47 in Docker and got an id_token from a password grant, at 10 MB of RAM. Restarts drop sessions.
The other thing holding it back: compatibility. N-API addons (bcrypt, sharp, @napi-rs/*, argon2) work fine. But old V8 native addons, like anything using `nan`, can segfault under pointer compression. That's the tax you pay.
October 19, 2026 at 3:59 PM
The other thing holding it back: compatibility. N-API addons (bcrypt, sharp, @napi-rs/*, argon2) work fine. But old V8 native addons, like anything using `nan`, can segfault under pointer compression. That's the tax you pay.
@simfrisk.bsky.social moved Classync, a video review app, off Netlify, Render, Atlas and Cloudinary onto OSC in a 3.5 minute cutover. Passwords survived, the bcrypt hashes copied intact, and old links 301 to the new site. Tip: sort explicitly, FerretDB orders unsorted queries differently than Atlas.
Leaving Netlify and Render without losing a user, a video or a link
Eyevinn Open Source Cloud Dev Blog
dev.to
October 19, 2026 at 8:14 AM
@simfrisk.bsky.social moved Classync, a video review app, off Netlify, Render, Atlas and Cloudinary onto OSC in a 3.5 minute cutover. Passwords survived, the bcrypt hashes copied intact, and old links 301 to the new site. Tip: sort explicitly, FerretDB orders unsorted queries differently than Atlas.
I built security defenses my blog doesn't need: a dummy bcrypt hash, HMAC'd IP buckets, magic-byte sniffing. I knew that since working on them, but did it anyway, to learn them where a mistake doesn't cost anything.
What I'd keep, and what I wouldn't: roland.leth.ro/blog/tech/wh...
#WebDev
What I'd keep, and what I wouldn't: roland.leth.ro/blog/tech/wh...
#WebDev
October 18, 2026 at 6:02 PM
I built security defenses my blog doesn't need: a dummy bcrypt hash, HMAC'd IP buckets, magic-byte sniffing. I knew that since working on them, but did it anyway, to learn them where a mistake doesn't cost anything.
What I'd keep, and what I wouldn't: roland.leth.ro/blog/tech/wh...
#WebDev
What I'd keep, and what I wouldn't: roland.leth.ro/blog/tech/wh...
#WebDev
6/ arm64 is 20% cheaper per GB-second. Code only knows "Zip package, no layers". The LLM reads requirements.txt / package.json for compiled x86 wheels, old sharp or bcrypt without arm64 prebuilds, vendored binaries.
Prefer a blocker over a guess. Diff touches architectures only.
Prefer a blocker over a guess. Diff touches architectures only.
October 18, 2026 at 1:14 AM
6/ arm64 is 20% cheaper per GB-second. Code only knows "Zip package, no layers". The LLM reads requirements.txt / package.json for compiled x86 wheels, old sharp or bcrypt without arm64 prebuilds, vendored binaries.
Prefer a blocker over a guess. Diff touches architectures only.
Prefer a blocker over a guess. Diff touches architectures only.
Imagine 50,000 login attempts a minute from 30,000 IPs. Per-IP limits miss it. bcrypt burns CPU on every guess. Judge the request before bcrypt: trusted, borderline, or confident bot. Does your login check first?
October 16, 2026 at 2:50 PM
Imagine 50,000 login attempts a minute from 30,000 IPs. Per-IP limits miss it. bcrypt burns CPU on every guess. Judge the request before bcrypt: trusted, borderline, or confident bot. Does your login check first?
৫০ হাজার login চেষ্টা, ৩০ হাজার IP থেকে। Per-IP limit ধরে না। bcrypt প্রতিটা ভুল guess-এ CPU পোড়ায়। তাই bcrypt-এর আগে বিচার করুন: বিশ্বস্ত, সন্দেহজনক, নাকি নিশ্চিত bot। আপনার login কোনটা করে?
October 16, 2026 at 2:50 PM
৫০ হাজার login চেষ্টা, ৩০ হাজার IP থেকে। Per-IP limit ধরে না। bcrypt প্রতিটা ভুল guess-এ CPU পোড়ায়। তাই bcrypt-এর আগে বিচার করুন: বিশ্বস্ত, সন্দেহজনক, নাকি নিশ্চিত bot। আপনার login কোনটা করে?
A validation rule keeps overly long passwords out of your forms. But if one ever slips past it, would you rather bcrypt truncate it quietly or fail loudly? masteringlaravel.io/daily/2026-1...
A final safety net for bcrypt's 72 byte limit | Mastering Laravel
So it fails loudly if something slips through
masteringlaravel.io
October 15, 2026 at 12:26 PM
A validation rule keeps overly long passwords out of your forms. But if one ever slips past it, would you rather bcrypt truncate it quietly or fail loudly? masteringlaravel.io/daily/2026-1...
A JWT-based auth API is live: bcrypt password hashing, route protection middleware, identical error messages to prevent user enumeration, and a fail-fast check for a missing JWT secret.
zoltanlederer.com/blog/practic...
#Node #Express #TypeScript
zoltanlederer.com/blog/practic...
#Node #Express #TypeScript
Authentication - Zoltan Lederer
A JWT-based authentication API: bcrypt password hashing, route protection middleware, and a fail-fast check for a missing JWT secret.
zoltanlederer.com
October 14, 2026 at 7:02 PM
A JWT-based auth API is live: bcrypt password hashing, route protection middleware, identical error messages to prevent user enumeration, and a fail-fast check for a missing JWT secret.
zoltanlederer.com/blog/practic...
#Node #Express #TypeScript
zoltanlederer.com/blog/practic...
#Node #Express #TypeScript