Putting It All Together

Layers built:

What we glossed over:

• Pepper: a SECRET application-wide value mixed into hashing. Provides defense-in-depth. Stored in env, not DB.
• Multi-factor auth: TOTP, hardware keys, WebAuthn. Independent layer above passwords.
• Password policies: complexity rules, length minimums, breach lists (Have I Been Pwned).
• Account lockouts: throttle login attempts.
• Password reset flows: secure tokens, expiry, single-use.

Recommendations (2024):

1. New code: argon2id, m=19MiB, t=2, p=1.
2. Existing bcrypt: keep, bump cost to 12+.
3. Anything else: migrate to bcrypt or argon2id ASAP.
4. NEVER: SHA, MD5, custom XOR schemes.

Use a library. Don't implement primitives yourself. Side channels and parameter choices are subtle.

OWASP's Authentication Cheat Sheet is the best continuously-updated reference.