The Weakest Secret You Decide By Default

No matter how strong your encryption is, an endpoint — a person, a laptop, a service account — authenticates with a password somewhere. Password security is the discipline of making the secrets humans and machines actually use expensive to guess, safe to store, and survivable to lose.

What Makes a Password Weak

There are three compounding threats, and none is "it's a short word". Brute force tries every combination; length dominates here, because adding a character multiplies the search space exponentially. Dictionary/combo attacks try known passwords and password-pattern combinations; common favorites ("Summer2024!", "qwerty123") fall to millions of guesses per second. Credential stuffing reuses username/password combinations leaked from other breaches — the attacker does not guess at all, they replay what they already own. The single worst habit is password reuse: one breach on a random forum now opens your email, which unlocks your bank, which can authorize its own reset. Credential stuffing is the weaponization of reuse, and its scale is staggering — leaked passwords for millions of accounts circulate for free, and attackers automate the trial across every major site within hours of a dump. Everything else is secondary.

Long passphrases beat complex lookalikes. correct-horse-battery-staple (four random words, one 37-character phrase) is easier to type, easier to remember, and millions of times harder to brute force than P@ssw0rd!2024. Entropy, not symbol soup, is the currency.

Storage: The Protocol Is Hashing

When you build auth, never store plaintext or reversible values. Store a salted, slow hash (Argon2id, scrypt, or bcrypt — the hashing lesson), never the raw password. That is both good practice and, in many jurisdictions, law. A leaked hash database with per-user salts means attackers must grind each account individually instead of reading a spreadsheet of passwords. Equally: never invent your own scheme, never roll your own crypto, never build a "reversed then Base64'd" password — it is reversible, which is everything storage already forbids.

Verification and Lockout That Block Attacks

Login logic is the attack surface. Rate-limit login attempts to slow brute force; lock or delay after repeated failures to stop online guessing; validate server-side everywhere (client-side checks are theater). For high-value actions (password change, transfer, admin actions) require re-authentication or MFA. Track suspicious patterns — many distinct IPs on one account, or attempts arriving over time — and log them for the incident-response lesson to use later. Pair every high-value action with a re-verification, and consider device-based passkeys where the user experience can carry it.

The Human Layer: Managers and Phishing

Hygiene is infrastructure. A password manager (Bitwarden, 1Password, KeePass) generates a unique random password per site, stores it encrypted, and removes the reuse problem entirely — the master password is the only one a human must remember, so it should be a long phrase plus MFA. Phishing beats any password: the attacker presents a fake login page and collects whatever you type. MFA (ideally a hardware key with FIDO2/WebAuthn) is the wall behind the password, and phishing-resistant passkeys are the direction modern auth is heading: a device-bound, non-replayable credential that no credential-replay attacker can use by typing it somewhere else.