📚 Standard basis: NIST SP 800-63B requires server-side password storage with slow hashes + salt (Argon2id/bcrypt/PBKDF2); OWASP recommends Argon2id first. This tool's XOR stream cipher is an educational demo and does not meet production standards — do not store real sensitive credentials here.