Secure Hashing (Argon2 / bcrypt) & JWT Token Security
Differentiate between encryption and key-derivation password hashing (bcrypt, Argon2), and implement secure JWT authentication.
Password Hashing & JWT Security Rules
### Password Hashing Invariants
Passwords must NEVER be stored in plain text or encrypted using reversible symmetric keys. They must be hashed using salted, adaptive Key Derivation Functions (KDFs) like **Argon2id** or **bcrypt** with work factors tuned to mitigate GPU brute-forcing.
