How should I store passwords and secrets?

Definition:

Password hashing turns a password into a one-way verification value using an intentionally expensive algorithm. Secret management protects credentials that the application must be able to use again, such as database passwords or API keys. Passwords should not be reversibly encrypted just so they can be compared at login.

Key points:

• Hash passwords with a suitable password-hashing algorithm and a unique salt.

• Store app secrets in a secret manager and grant only required access.

• Rotate exposed credentials; removing them from the latest commit is not enough.

• A salt prevents identical passwords from producing identical stored hashes; cost settings should be chosen for the actual server workload.

Interview point:

• Hash user passwords, protect reusable credentials, and never confuse encoding such as Base64 with encryption.