26/43 freelancers chose “plaintext” to store passwords

The right approach from the developers who decided to store text as plain text, would have been to highlight this to the requestor, and indicate that it would cost extra. More business for them, and better end result for the requestor.

I don't know what the industry actually does, but what it should probably do is use bcrypt.

https://en.wikipedia.org/wiki/Bcrypt

While somewhat better than plaintext, SHA-256 is far too easy/fast to slow down dictionary attacks.

Practically speaking, the best practice is to use a previously vetted library that provides high-level password storage solutions based on the recommendations below. Developers should not be reinventing the wheel to solve these problems for each job.

Having said that, here are the main factors:

- Choose a function that's designed to be slow to compute (and preferably that can't be easily optimized by throwing memory at the problem). Bcrypt, scrypt, and pbkdf2 are the most common solutions. Argon2 was the winning candidate of the 2013 - 2015 password hashing competition and is gradually starting to appear in more places.

- In addition to choosing the right function, hashes should be salted with a random value (that's stored with the hash) to prevent pre-computation and attacking multiple hashes in parallel.