# Password Protection

## Introduction

![](https://1374779285-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFW3x2aqEO8GF2kr3VU%2Fuploads%2FCAj8sQ6LZTnipw2Qu6EY%2Fimage.png?alt=media\&token=247a7ef4-1f7b-402c-b9c3-7937deeecaaf)

* Password will not be stored into database directly
* Password will be hashed with salt in one-way direction and store in db
* The stored hashed will used to compare the user entered password to see whether it is matched or not

## Salt

* a salt is a unique, randomly generated string that is added to each password as part of the hashing process
* Generate unique hash value to prevent from hacker attack

## Hacker Attack

### Dictionary attack

* A dictionary attack is a brute-force method that tries to guess a password by using a list of common or likely words, phrases, or combinations.
* For example, if you want to crack the password of a user named Alice, you might try words like alice, alice123, alice1984, or alice!@#. The dictionary attack can also use variations of these words, such as changing the case, adding numbers or symbols, or using leet speak.
* Simple and Fast if the dictionary size is small

### Rainbow table attack

![](https://1374779285-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFW3x2aqEO8GF2kr3VU%2Fuploads%2F1oSXK3mki9KFYoRgbZ5n%2Fimage.png?alt=media\&token=66b190b3-dc49-4a4e-844e-c2ffe3290ae6)

* A rainbow table is a precomputed table that stores the hashes and the corresponding plain texts of a large set of possible passwords.
* It requires lots of space for storage
* Doing reverse-lookup to find whether the hashed password is existed in the table or not and then find the plain text
* The efficiency will be higher if the dictionary size is large


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://petercheng7788.gitbook.io/developer-note/backend/login/password-protection.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.