Our possible new customer asks if salesforce uses any strong algorithm encryption for user credentials.
Somebody knows how salesforce stores passwords? Any documentation? I have found nothing.
I suppose one of these https://trust.salesforce.com/en/compliance/ would cover your requirement at least from business perspective (i.e. without disclosing technical details)
I don't believe any organization that follows data security standards is storing or should be storing user passwords in any form - plain text or encrypted. Password validation can be done by using stored MD5 hashes of the password.