What is password hashing?
Password hashing stores a one-way transformation of each password instead of the password itself. A slow, salted algorithm such as bcrypt, scrypt, or Argon2 makes stolen hashes very expensive to crack. Passwords should never be stored in plain text or with reversible encryption.
What the buyer is really asking
If your database leaked, would the passwords be usable? Buyers look for a slow, salted hashing algorithm, or confirmation that an identity provider stores passwords so you never hold them.
Other ways buyers ask it
Every one of these wants the same answer:
- “How are user passwords stored?”
- “What hashing algorithm do you use for passwords?”
- “Are passwords salted?”
Evidence to have ready
- The hashing algorithm and parameters in use
- Your identity provider's documentation, if it stores passwords on your behalf
How Tyrvar answers this
Tyrvar treats every wording above as one question. You write the answer once, attach the evidence, and revisit it when your setup changes. Each buyer gets that approved answer no matter how their questionnaire words it. If you have not answered it yet, Tyrvar flags the question for you and does not make something up. Try it on your own questionnaire.