Topic: authentication

• Storing passwords and API keys

  Passwords are stored only as salted, slow hashes (Argon2id, scrypt, bcrypt); high-entropy API keys can use a keyed fast hash; both are compared in constant time and never logged or returned after issue.

  article · en · unreviewed

Machine-readable: JSON