How password hashing works: bcrypt, Argon2, and why plain text storage is malpractice

Not all hashing is equal. A simple SHA-256 hash of a password is fast to compute, which means it's fast to brute-force. Modern password hashing algorithms (bcrypt, Argon2, PBKDF2) are deliberately slow and memory-intensive. bcrypt has a configurable cost factor that doubles the work with each increment. Argon2 (the winner of the 2015 Password Hashing Competition) adds memory hardness, making it expensive to attack with GPUs and ASICs.

If a website emails you your password in plain text after signup, they are storing it without hashing, which is a serious security failure. Close your account immediately. You can't fix their security, and if they're doing that wrong, everything else is probably wrong too.

Never reuse a password, because you can't see how any site stores it. Hashing quality varies: SHA-256 is fast, which makes brute force fast, whereas bcrypt doubles work per cost factor and Argon2 adds memory hardness that punishes GPUs and ASICs.

A service that can email you your existing password is storing it in a form it can read back, not hashed, which signals broader neglect. Unique passwords plus 2FA contain the blast radius when the worst case happens.