Of all the data an HR system holds, login credentials are the master key. If passwords are mishandled, every salary record, ID document, and performance review behind them is exposed too. Even so, password storage is one of the least understood parts of HR software security. The most important question you can ask a vendor is a simple one: how do you store passwords? The right answer is hashing. Below we explain what that means, why it matters and what to ask for.

Why plain text is a disaster

Some systems still store passwords as readable text in a database. It feels convenient, until that database is leaked, stolen, or accessed by a malicious insider. Once plain-text passwords get out, attackers have everything. And because people reuse passwords, one HR breach can lead to break-ins on email, banking and other company systems. If a vendor can show you your own password, retrieve it, or email it to you, it is stored insecurely. There is no acceptable version of that.

What hashing actually does

Hashing runs a password through a one-way mathematical function. The system stores only the resulting hash, never the password itself. When you log in, the system hashes what you typed and compares it to the stored hash. If they match, you are in. The original password cannot be worked back out of the hash. Even the platform's own administrators cannot read it.

But not all hashing is equal. Old, fast algorithms can be brute-forced by modern hardware in moments. That is why the industry standard for credential storage is a deliberately slow, salted algorithm like bcrypt.

Why bcrypt and salting matter

Salting adds a unique random value to each password before hashing. This means two employees with the same password get completely different hashes, defeating precomputed lookup tables.
Slowness is a feature. Bcrypt is intentionally expensive to compute, so an attacker trying billions of guesses is throttled to a crawl, while a single legitimate login stays instant.

In Zaffre HRM, passwords are hashed with bcrypt and are never stored or viewable in readable form. Not by colleagues, not by managers, not by administrators. We don't make exceptions to this, because the only password that is really safe is one nobody can read.

Hashing is necessary but not sufficient

Secure password storage is the foundation, but it works alongside other controls:

Encryption in transit. Your password must travel to the server over TLS so it is never exposed on the network. Zaffre Axon enforces TLS on every connection.
Signed session tokens. After login, Zaffre Axon issues RS256-signed tokens so sessions cannot be forged.
Role-based access control. Even authenticated users only see what their role permits. Zaffre HRM's granular RBAC ensures no employee can view another employee's credentials or restricted data.
Access restrictions. IP, device, and geo restrictions limit where logins can even originate.

What to ask your vendor

You do not need to be a cryptographer to vet a vendor. Ask these questions and listen carefully:

Are passwords hashed with bcrypt (or an equally strong, salted, slow algorithm)?
Can anyone, including admins, view a user's password? The correct answer is no.
Is every credential transmitted over TLS?
How are reset flows handled so they never expose the old password?

If a vendor hesitates on any of these, treat it as a red flag. Credential handling reveals how seriously a company takes the rest of its security, because it is one of the simplest things to get right and one of the most damaging things to get wrong. A team that has thought carefully about password storage has almost certainly thought about encryption, access control and auditing too. A team that brushes the question off has already given you your answer.

What happens during a reset, and why it matters

Password resets are a good test of whether a system is built properly. In a secure design, a reset never reveals or reuses the old password, because the old password is not retrievable in the first place. Instead, the user proves their identity and sets a brand-new password, which is then hashed and stored. If a system can email you your existing password during a reset, it is storing that password in a recoverable form, which means it is not truly hashed. Watch how a vendor handles resets; it confirms what they told you about storage.

Security as a built-in standard

At Zaffre Tech, we treat password security as a baseline, not a premium feature. Hashed credentials, encrypted transit and storage, signed tokens, and granular access control are all part of the same connected security model that protects HR, payroll, attendance, operations, finance, and communication on one platform. You can read more on our security overview.

Your employees trust you with their most sensitive data. Make sure your software earns that trust at the most basic level. Book a demo to see how Zaffre Axon protects every credential.

Password Security in HR Software: Why Hashing Matters