Hashing login and password? For a login the user credentials are typically some form of "username" and a matching "password".

The password is (hopefully) stored as a hash in the database.

But what about the username?

Is the username stored as a plaintext in the database?

Would it be a good idea to hash both the username and the password?
If username was treated as the password should be, like salad (salt, pepper, hash, toss / en Français saler, poivrer, hacher, touiller), then


If there is salt, it can't be directly inferred from username. And the alternatives are getting rid of salt (allowing pre-computation and rainbow tables), or test all users (which is going to be prohibitively costly for more than a few users).
If the username doubles as storage of the email, then we can no longer readily send an email to all users. And if we can send such general email, there is the risk that likely usernames can be inferred from email.
Username is even more guessable than password, and (unless treated as an extension of password) if can be found even more easily.


For these reasons, it is typically functionally unacceptable to apply a password hash to username.