In the OWASP list of top ten vulnerabilities that affect web applications Broken Authentication comes in second.  It means that a potential attacker can exploit the connection between the visitor’s browser and the API server to steal credentials. If the passwords are encrypted using a weak algorithm the attacker can easily reverse the encyprted password to plain text. In tip 2 we have seen a method to address the broken authentication vulnerability, in this post we will examine the ways to harden the passwords before it can be persisted to the database.