About Course
If your application has user accounts, how you store and check passwords matters enormously when a database is stolen. Based on the OWASP Password Storage Cheat Sheet and NCSC password guidance, this course covers why passwords must be hashed not encrypted, salts and peppers, choosing Argon2id or another password hashing function, upgrading legacy hashes, and login policies such as throttling and MFA.
Tutwoo is an independent learning provider. This course is general training based on OWASP and NCSC guidance. Recommended parameters change over time, so always check the current guidance. It is not endorsed by those organisations.
© 2026 Tutwoo UK Limited. This course was created in-house by Tutwoo and is our original work. It is for your own learning only: please do not copy, share, record or resell it.
Course Content
Course Lessons
-
Hashing, not encryption – and why speed is the enemy
-
Choosing an algorithm and settings
-
Upgrading legacy hashes and wider login security
Sources & Further Reading
Final Assessment
Student Ratings & Reviews
