Run only the supplied app on your own computer at 127.0.0.1. Do not deploy it, expose it through a tunnel, or bind it to a public network.
Use Campus-demo-42! and Wrong-demo-42!, never your real passwords. The fields are deliberately visible for learning.
The one fictional account is stored in memory. Restarting the server deletes it. No real user data is required or written to a database.
The storage inspector and decoder are teaching-only endpoints. A real application must not expose password records to users.
Do not scan, probe or attempt to decode credentials belonging to another person or service.
The repaired app demonstrates password storage only. It has no real sessions, account recovery, persistent database, production rate limiting or HTTPS deployment.
Hashing makes password guessing more costly; it does not make weak passwords unguessable. Hiding or changing the inspector does not repair storage.
The helper uses memory-hard hashing and may pause briefly. Close duplicate lab servers. Ask the instructor for help if your machine cannot run it; do not lower hashing settings merely to pass checks.