A pragmatic guide to password hashing

Never store plaintext, and never use fast hashes like MD5 or SHA-256 for passwords. Use a slow, salted algorithm such as bcrypt or argon2.