Forgot password dabane pe company tumhara purana password wapas kyun nahi bhejti, sirf reset link kyun? Kya company ko tumhara password pata hota hai? Password database mein kaise store hota hai, aur leak ho jaaye toh kya hota hai?
Is Short mein ek password ka poora safar follow karo: signup se database tak, aur login pe wapas.
SCALE THEORY · SYSTEM DESIGN 005: password hashing + salt, simple Hinglish mein. “Passwords kaise store karoge?” login / authentication system design interview ka sabse common sawaal hai.
📍 Kya seekhoge
1) Hashing kya hai: signup pe server password ko ek ek-tarfa formula (hash function) mein daalta hai. Bachta hai ek lamba code. Code se password wapas nahi banta. Database mein sirf code rakha jaata hai.
2) Login kaise check hota hai: tumhara daala hua password phir usi formula se guzarta hai. Naya code database wale code se mila, toh tum andar. Password kabhi store nahi hua.
3) Problem: do logon ka password same ho, toh code bhi same. Hackers ke paas common passwords ke code ki list pehle se taiyaar hoti hai (lookup / rainbow table). Leak hua database, aur common passwords turant pakde gaye.
4) Salt kya hai: server har user ke password mein ek alag random string milata hai, phir hash karta hai. Ab password same, par code alag. Hacker ki taiyaar list bekaar.
5) Isliye Forgot password pe sirf reset link aata hai: company ke paas purana password hai hi nahi.
🛵 Ek password ka safar, step by step (video ke saath)
0:00 Forgot password: purana password nahi, sirf reset link
0:03 Company ke paas tumhara password hai hi nahi
0:06 Signup: password formula mein, pees diya
0:09 Lamba code, wapas password nahi banta: ise kehte hain hashing
0:14 Login: wahi formula, code match, tum andar
0:18 Sawaal: same password, toh code bhi same?
0:21 Hackers ki common passwords wali taiyaar list
0:24 Har user ka alag random masala: ise kehte hain salt
0:29 Salt matlab namak, sach mein
0:31 Password same, code alag, list bekaar
0:34 Purana password company ne kabhi rakha hi nahi
0:38 Agla: login ke baad app tumhe yaad kaise rakhta hai?
🧠 Terms (interview ke liye)
• Hash function: ek-tarfa formula. Same input = hamesha same output, par output se input wapas nahi nikalta.
• Hashing: password ki jagah uska hash (code) store karna.
• Salt: har user ke liye alag random value, password ke saath hash hoti hai. Secret nahi hai, hash ke saath hi database mein rakhi jaati hai.
• Rainbow table / lookup table: common passwords ke pehle se nikale hue hash ki list.
• Slow hash (bcrypt, scrypt, Argon2, PBKDF2): jaan boojh ke dheema formula, taaki har guess mehenga pade.
🎯 Interview mein pucha jaaye: “Users ke passwords kaise store karoge?”
Ek line: plain text kabhi nahi; har user ka unique random salt banao, password + salt ko slow password hash (Argon2id ya bcrypt) se hash karo, database mein salt + hash rakho; login pe same process chala ke compare karo.
Follow-up: “Normal SHA-256 kyun nahi?” SHA-256 bahut tez hai, attacker ek second mein karodon guess try kar sakta hai. Password ke liye dheema, tunable hash chahiye.
Follow-up 2: “Forgot password?” Purana password bhejna possible hi nahi; ek baar chalne wala reset token mail karo.
🤔 Common galatfehmi
• “Hashing = encryption.” Nahi. Encryption key se wapas khulta hai, hash wapas nahi khulta.
• “Salt secret hota hai.” Nahi. Salt ka kaam har code ko alag banana hai, chhupna nahi.
✍️ Khud socho
• Agar koi website Forgot password pe tumhara purana password hi mail kar de, toh uska matlab kya hai?
📏 Numbers ka hisaab
• SHA-256 ka code: 64 hex characters, password chhota ho ya lamba.
• Example: “pass@123” ka SHA-256 hamesha d9708691… se shuru hota hai, kisi bhi computer pe.
• Salt ke saath: “k9#Q” + “pass@123” → 9b9bd905…, “Zt4!” + “pass@123” → c5992e21… (same password, alag code).
• NIST: salt kam se kam 32 bit ka ho.
❓ Is video mein jawab
• Forgot password pe purana password kyun nahi milta?
• Company password kaise store karti hai?
• Password hashing kya hai, encryption se kaise alag?
• Salt kya hai, kyun zaroori hai?
• Rainbow table attack kaise rukta hai?
⚠️ Simple kiya hai: video mein SHA-256 sirf samjhane ke liye hai; asli sites bcrypt / Argon2 jaise slow formula chalati hain. Achhi companies aise hi rakhti hain, par kuch sites aaj bhi galti karti hain.
📌 Sources
• OWASP Password Storage Cheat Sheet (Argon2id, bcrypt, salting)
• NIST SP 800-63B: memorized secrets salted + hashed
• OWASP Forgot Password Cheat Sheet (reset token, password kabhi mail nahi)
• RFC 9106 (Argon2)
Aur tum? Sab jagah ek hi password, ya har app ka alag alag? Comment mein batao 👇
Save kar lo, agle system design interview mein kaam aayega.
#shorts #systemdesign #passwordhashing #cybersecurity #systemdesignhindi #backend #authentication #interviewprep #techhindi
source
Sach batao, kitne apps pe ek hi password chal raha hai? 😅