http://maverick.i2p/blog/darknet-dev
Passwords must be hashed using memory-hard algorithms like Argon2id with cost factors that make brute force economically painful. Session tokens, reset links, and API keys must be long, unpredictable, and generated via OS-level cryptographically secure random generators (CSPRNG), not weak pseudo-random libraries or timestamp hashes.