Last updated: August 27, 2026.
Store password hashes, not encrypted or plaintext passwords. Use Argon2id, scrypt, bcrypt, or PBKDF2 through an audited component or authentication service.
ALTER TABLE Users
ADD PasswordHash VARCHAR(255) NOT NULL;<%
' PasswordHasher is an audited COM component or internal service.
Dim isValid
isValid = PasswordHasher.Verify(Request.Form("password"), storedPasswordHash)
If isValid Then
' Rotate the session identifier and complete sign-in.
Else
' Return the same generic error for every failed login.
End If
%>| Migration step | Action |
|---|---|
| Add modern column | Store self-describing encoded hashes. |
| Upgrade on login | After a successful legacy check, create a modern hash and remove the old value. |
| Reset when needed | Force password resets for accounts that cannot be migrated. |
| Protect login | Rate-limit attempts and add MFA where appropriate. |
Do not use MD5, SHA-1, or a single fast SHA-256 hash. Follow the OWASP Password Storage Cheat Sheet.
