{
  "id": "04",
  "content": [
    {
      "type": "heading",
      "text": "Salts & Pepper"
    },
    {
      "type": "text",
      "html": "Salts are unique per password (stored with hash). Pepper is a server-side secret added pre-hash and stored outside DB."
    },
    {
      "type": "text",
      "html": "<pre><code class='language-php'>$pep=$_ENV['APP_PEPPER'];\n$pwdPep=hash_hmac('sha256',$pwd,$pep,true);\n$hash=password_hash($pwdPep,PASSWORD_ARGON2ID);\n</code></pre>"
    }
  ],
  "quiz": {
    "questions": [
      {
        "id": "q1",
        "type": "single",
        "text": "Where to store pepper?",
        "options": [
          {
            "id": "a",
            "text": "Env/secret manager"
          },
          {
            "id": "b",
            "text": "Database"
          },
          {
            "id": "c",
            "text": "Client JS"
          }
        ],
        "correct": [
          "a"
        ]
      },
      {
        "id": "q2",
        "type": "single",
        "text": "Salts make hashes:",
        "options": [
          {
            "id": "a",
            "text": "Unique per password"
          },
          {
            "id": "b",
            "text": "Faster to crack"
          },
          {
            "id": "c",
            "text": "Encrypted"
          }
        ],
        "correct": [
          "a"
        ]
      }
    ]
  }
}