Why passwords are stored as hashes

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A website stores your password. Which is the safer way to store it?

A Store a hash of the password

B Store the real password so it can be checked easily

2. You log in with the password 'blue42'. The system hashes what you typed. What does it do next?

A Unscrambles the stored hash back into 'blue42'

B Compares the new hash to the stored hash

3. Two users type exactly the same password with the same hashing method. What happens?

A They get the same hash

B They get two completely different hashes

4. Which statement about a hash is true?

A It can be decoded with the right key

B It can't be reversed back into the password

5. A hacker steals a database that only holds password hashes. What do they get?

A Scrambled values, not the real passwords

B A list of every user's real password

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1hash("cat123") → 8f3a91c2		Ahash("cat123") == hash("cat123")
2hash(attempt) == stored_hash		Bunhash("8f3a91c2") → impossible
3The same input always gives the same hash, so a correct password matches the stored hash		CThe password is turned into a scrambled value that gets stored instead of the real password
4A hash can't be reversed, so a thief with the database can't simply read the passwords		DThe typed password is compared directly with the hash. The attempt must be hashed first, so they will never match.
5stored_password = "cat123"		EThe real password is saved in plain text. If the database is stolen, the thief can read every password straight away.
6if attempt == stored_hash:		FThe login check: hash what the user typed and compare it with the saved hash

Definitions

hash

Fill in the Blanks

Complete each line of code by filling in the missing parts.

stored ← ____(password)

stored ← hash(password) IF hash(attempt) _ stored THEN OUTPUT "Login ok"

h1 ← hash("sunny") h2 ← hash("sunny") IF h1 = __ THEN OUTPUT "Same"

INPUT password SAVE hash(________) TO database

INPUT password stored _ hash(password)

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A stored ← password

B save(user, stored)

C print('Account created')

Question 2

A password ← input('New: ')

B stored ← hash(user)

C save(user, stored)

Question 3

A typed ← input('Password: ')

B attempt ← hash(typed)

C stored ← load(user)

D IF typed = stored THEN

E print('Welcome')

Question 4

A theft ← stolen_hash

B guess ← reverse(theft)

C IF hash(guess) = theft THEN

D print('Guess matches')

Question 5

A h1 ← hash('Fish99')

B h2 ← hash('fish99')

C print(h1 = h2)

Answer Key

Why passwords are stored as hashes

Section A: Quick Questions

A — Store a hash of the password

B — Compares the new hash to the stored hash

A — They get the same hash

B — It can't be reversed back into the password

A — Scrambled values, not the real passwords

Section B: Match the Pairs

hash("cat123") → 8f3a91c2 → The password is turned into a scrambled value that gets stored instead of the real password

hash(attempt) == stored_hash → The login check: hash what the user typed and compare it with the saved hash

The same input always gives the same hash, so a correct password matches the stored hash → hash("cat123") == hash("cat123")

A hash can't be reversed, so a thief with the database can't simply read the passwords → unhash("8f3a91c2") → impossible

stored_password = "cat123" → The real password is saved in plain text. If the database is stolen, the thief can read every password straight away.

if attempt == stored_hash: → The typed password is compared directly with the hash. The attempt must be hashed first, so they will never match.

Section C: Definitions

hash — A one-way scrambled value made from a password. A system stores it instead of the real password and checks a login by hashing what you type and comparing. It can't be reversed.

Section D: Fill in the Blanks

stored ← hash(password)

stored ← hash(password)
IF hash(attempt) = stored THEN
  OUTPUT "Login ok"

h1 ← hash("sunny")
h2 ← hash("sunny")
IF h1 = h2 THEN OUTPUT "Same"

INPUT password
SAVE hash(password) TO database

INPUT password
stored ← hash(password)

Section E: Spot the Error

A — The system should store the hash of the password, not the real password. It should be stored ← hash(password), so a stolen database does not reveal real passwords.

B — This hashes the username instead of the password. The password is what needs protecting, so it should be stored ← hash(password).

D — This compares the plain typed password with the stored hash, so they will never match. It should compare the hash of what was typed: IF attempt = stored THEN.

B — A hash cannot be reversed back to the password. A thief can only guess a password, hash it and compare, so it should be guess ← 'mango7'.

B — The same input always gives the same hash, but a different input (even just a different capital letter) gives a different hash. For h1 = h2 to be true, line 2 must be h2 ← hash('Fish99').