How should passwords be stored securely?

Never store plaintext passwords. **Best practice:** - Use a slow, adaptive hash like **Argon2id** (or bcrypt/scrypt). - Use a unique **salt** per password (usually built into libs). - Consider a **pepper** stored separately (optional). - Enforce MFA and rate limits on login. Also store only what you need and log auth events safely (no sensitive data).