SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-password-hash-choice

Which of these is a poor choice for storing passwords because it is a fast hash?

Plain SHA-256, it is built for speed, so attackers can guess quickly.

Start playing free

  1. Argon2id
  2. bcrypt
  3. Plain SHA-256 ✔

Why: Password storage should use slow, tunable algorithms so each guess is costly. Argon2id, bcrypt and PBKDF2 do this, which is called key stretching.

Huh, didn't know that: OWASP lists Argon2id, bcrypt and PBKDF2 as strong, slow hashing choices for passwords.

The dad joke
Password looks at itself in the mirror: "Don't listen to Google. You are a strong, confident password."
Like this card?
Play the game

References

Answer: Plain SHA-256. Password storage should use slow, tunable algorithms so each guess is costly. Argon2id, bcrypt and PBKDF2 do this, which is called key stretching.

  1. OWASP Password Storage Cheat Sheet cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
    Instead, they must be protected using strong, slow hashing algorithms such as Argon2id, bcrypt, or PBKDF2.
    Checked 2026-10-10.
  2. OWASP Password Storage Cheat Sheet cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
    Fast hashing algorithms such as SHA-256 are not suitable for password storage
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyHow long is a SHA-256 hash output, called the message digest?Security & PrivacyAdding a unique random salt to each password before hashing mainly defends against what?Security & PrivacyNIST's digital identity guidelines say a password salt must be at least how long?

That's stuff everyone should know.