Thread by @PwdRsch

Researchers asked 43 freelance developers to code the user registration for a web app and assessed how they implemented password storage. 26 devs initially chose to leave passwords as plaintext. [PDF] net.cs.uni-bonn.de/fileadmin/user…

Those devs were then asked to rewrite their code to 'store passwords securely.' Overall here are the methods of password storage chosen by the developers:
8 - Base64
3 - AES
3 - 3DES
10 - MD5
1 - SHA-1
5 - SHA-256
5 - PBKDF2
7 - Bcrypt
1 - HMAC/SHA1

Base64 is not a 'secure' solution, but some devs seemed to think so, with one saying "it is very tough to decrypt." Only 3 devs implemented salting along with MD5, SHA-1, SHA256, HMAC-SHA1.

At least 16 participants did search for and copy the password hashing code from an online source. Although half of these still resulted in the use of MD5 or a similar poor choice.

If you are looking for better guidance on developing password storage solutions I'd recommend starting with the OWASP Password Storage Cheat Sheet github.com/OWASP/CheatShe…