How to Store Passwords Safely: What Martin Stoeckli's Tutorial Covers

Martin Stoeckli's site includes a tutorial on safely storing passwords, aimed at developers and technically minded users who need to decide how to handle credentials in their own projects. The core message is that passwords should never be stored in a form that lets anyone — including the person running the system — read them back. Instead, they should be run through a one-way hashing process, and the tutorial's "Hashing passwords" section is the place to look for the specifics. If you just want to understand the principle and the common mistakes, the summary below covers what the site points to.

The basic principle: store a hash, not the password

A password hash is the output of a one-way function: you can turn a password into a hash, but you cannot turn the hash back into the password. When a user logs in, you hash what they typed and compare it to the stored hash. If they match, the password was correct.

This means a stolen database does not directly hand over anyone's password — as long as the hashing is done properly.

What the tutorial points to

The site's own description of the tutorial is brief: it is about "Safely storing passwords," and the related page is titled "Hashing passwords." The homepage lists it under "Utilities/Tutorials" alongside a character map and a note about the debugger mouse, so it sits in the same section as Stoeckli's practical reference material rather than in the freeware tool listings.

The tutorial is written in the context of the programming languages Stoeckli works with — the site has separate tips sections for PHP, Delphi, and C#. That matters for how you read it: the advice is aimed at someone implementing password storage in an application, not at an end user choosing a password manager.

Common mistakes to avoid

Even without reproducing the tutorial line by line, the failure modes it addresses are well established and worth checking your own code against:

• Storing the password in plain text. The most basic error. Anyone with read access to the database — or a backup, or a log file — has every password.
• Using a fast general-purpose hash. Functions designed for speed are also fast for an attacker guessing billions of candidates. Password hashing needs to be deliberately slow.
• Skipping the salt. Without a unique random value per password, identical passwords produce identical hashes, and precomputed tables (rainbow tables) become useful.
• Rolling your own scheme. Combining hashes in a clever homemade way usually removes the properties that made the underlying function safe.
• Encrypting instead of hashing. Encryption is reversible by design. If the key leaks, every password leaks. Hashing has no key to leak.

How to apply this

If you are implementing password storage, the practical sequence is:

1. Choose a password-hashing function intended for the job, not a general-purpose digest.
2. Generate a unique random salt for each password and store it alongside the hash.
3. Tune the work factor so hashing takes a noticeable but tolerable amount of time on your hardware.
4. Store the full result — algorithm identifier, parameters, salt, and hash — so you can verify later and upgrade the parameters over time.
5. Verify by re-hashing the submitted password with the stored salt and parameters, then comparing.

The verification step should use a constant-time comparison so that the time taken does not reveal how much of the hash matched.

Where this fits on the site

martinstoeckli.ch is Stoeckli's personal homepage, and the password tutorial is one of several reference pieces there. The same site hosts freeware tools — SilentNotes (a WYSIWYG note-taking app for Android and Windows), ExplorerGenie (an Explorer context-menu extension), ColorBug (an on-screen color picker), and CopyPathMenu — plus programming tips for PHP, Delphi, and C#. The password tutorial is not a product page; it is guidance for developers, and it is worth reading in full if you are the one writing the storage code.