## Securing User Passwords Storing raw text passwords in databases is a catastrophic security risk. Modern systems hash passwords before storing them. ### The Hashing Verification Flow 1. **Hashing on Registration**: User signs up -> system generates a random string (Salt) -> concatenates salt with password -> computes cryptographically secure hash (e.g. bcrypt) -> stores Salt and Hash. 2. **Verification on Login**: User enters password -> system fetches Salt from database -> recalculates hash -> compares computed hash against database hash. If matches, access is granted.