Try “SSH”, “passkeys”, “WordPress” or “Content-Security-Policy”.
Section · 6 guides
Security Intelligent Code is our name and our habit. These guides are for developers who want to write software that fails safely: the classic vulnerabilities, secrets handling, dependencies, password storage and tokens.
/secure-code/The 2025 edition of the OWASP Top 10 reorders the classic web risks and adds a new one about error handling. What each category means, how it shows up in real code and what stops it.
High impact6 min
An API key in a repository is copied to every clone and every fork. How to keep secrets out of code, where to store them instead and what to do in the first hour after a key was committed.
High impact5 min
Much of the code you ship was written by someone else. How to pin and review dependencies, avoid typosquatting and dependency confusion, produce an SBOM and check what you install.
High impact6 min
SQL injection and cross-site scripting share one root cause: data that ends up being treated as code. Parameterised queries, context aware encoding and a Content Security Policy close that gap.
High impact5 min
Four algorithms are fit for storing passwords, and fast hashes such as SHA-256 are not. How Argon2id, scrypt, bcrypt and PBKDF2 compare, which parameters OWASP recommends and how to migrate.
High impact5 min
JSON Web Tokens are compact and convenient, and easy to get subtly wrong. What a token contains, which checks every verifier must make and when a plain session cookie is the better choice.
High impact5 min
Compare
Interactive comparison
Scores from 1 to 5 for storing user passwords in a web application, from the perspective of a small development team.
Best for new systems on any stack with a maintained Argon2 library.
Best where FIPS-140 compliance is mandatory.
Best where Argon2id is unavailable but a scrypt implementation is.
Best kept where it already runs, with a cost of 10 or more and a planned migration.
| Criterion | Argon2id | PBKDF2 | scrypt | bcrypt |
|---|---|---|---|---|
| Resistance to GPU cracking | ||||
| Standing in current guidance | ||||
| Library and platform support | ||||
| Ease of correct tuning | ||||
| FIPS-140 fit | ||||
| No input length pitfalls |
Editorial assessment as of 31 October 2026. Scores from 1 to 5, higher is better. Your weights only change the order. Read the full comparison
Tools for this section
