Jason’s Password Cryptography Lab

This page demonstrates the full lifecycle: Password → Salt → Combine → Hash → Store → Verify → Secure Hash.

Stored JSON Record

{
    "created_utc": "2026-02-11T15:04:40+00:00",
    "algorithm": "sha256_manual",
    "salt": "d3e4d459b447b168",
    "hash": "b3838653bfc3437adabb5c29c2a319cd3db467097e963d9bda5e5edd5696c94a"
}

What This Shows

SHA-256 always outputs 64 hex characters (256 bits).
Salt makes identical passwords produce different hashes.
Verification works by recomputing and comparing.
password_hash stores salt internally.
password_verify never decrypts anything.
Changing one character causes massive output change (avalanche effect).