08_Passwords — Passwords — the secret a human chose

Level: 201 · for anyone who stores a login

Everything else in this library assumes a key made of uniformly random bits. A password is not that. It is short, chosen from a small and heavily-skewed set, and reused — so the machinery has to be different, and the goal is not "unguessable" but expensive to guess at scale.

That is why a password store uses a deliberately slow function. Fast is the enemy here, which is the exact reverse of every other chapter.

The pages

#	Page	The question it answers	Status
1	Hashing a password	Why is a fast hash the wrong tool, and what is a salt for?	planned

Every page above is a plan until its row says written; see ROADMAP.md.

The through-line

Never a bare hash, always a KDF, always a per-user salt. Argon2id, scrypt or bcrypt; hashlib.scrypt and hashlib.pbkdf2_hmac are in the Python standard library, so there is no excuse reachable by 'we had no dependency'.