title: hashing + salt for java web application
body: <p>I have been told to not be creating my own salt and hashing methods. Due to the ones already existing in java being far superior. After looking into it a bit, I do not quite understand the following;</p>
  
  <ul>
  <li>What is the difference between creating the hash, and verifying it?</li>
  <li>If the salt is random everytime, don't you need a token to verify passwords other than the username?</li>
  </ul>
  
  <p>how do generate and verify hashed and salted passwords in an contemporary way for a java web application? </p>