Password Security: Best Practices for Creating and Storing Passwords

Password security encompasses the practices, tools, and policies for creating, storing, and managing passwords to protect accounts from unauthorized access. It includes strong password policies, multi-factor authentication, and secure password storage using salted hashing.

Password Security: Best Practices for Creating and Storing Passwords

Password security encompasses the practices, tools, and policies for creating, storing, and managing passwords to protect accounts from unauthorized access. Despite the rise of biometrics and passkeys, passwords remain the most common authentication method. Weak passwords are responsible for over 80 percent of data breaches. Password security includes two aspects: user-side (creating strong, unique passwords) and server-side (storing passwords securely using salted hashing). Understanding both is essential for building secure systems.

To understand password security properly, it helps to be familiar with authentication fundamentals, hashing, and multi-factor authentication.

Password security overview:

┌─────────────────────────────────────────────────────────────────────────┐
│                         Password Security                                │
├─────────────────────────────────────────────────────────────────────────┤
│                                                                          │
│   User-Side                             Server-Side                     │
│   (Creating passwords)                   (Storing passwords)             │
│   ┌─────────────────────────┐           ┌─────────────────────────────┐ │
│   │ • Use password manager  │           │ • Never store plain text    │ │
│   │ • Long, random passwords│           │ • Use salted hashing        │ │
│   │ • Unique per site       │           │ • Use slow hash function    │ │
│   │ • Enable MFA            │           │   (bcrypt, Argon2id)        │ │
│   └─────────────────────────┘           └─────────────────────────────┘ │
│                                                                          │
│   Common Attacks:                                                        │
│   ┌─────────────────────────────────────────────────────────────────┐   │
│   │ • Phishing       - Trick user into revealing password           │   │
│   │ • Credential     - Use stolen passwords from other breaches     │   │
│   │   Stuffing                                                       │   │
│   │ • Brute Force    - Try many password combinations               │   │
│   │ • Dictionary     - Try common passwords (123456, password)      │   │
│   │ • Keylogging     - Capture keystrokes to steal password         │   │
│   │ • Database       - Steal password hashes from server            │   │
│   │   Breach                                                         │   │
│   └─────────────────────────────────────────────────────────────────┘   │
│                                                                          │
└─────────────────────────────────────────────────────────────────────────┘

What Is Password Security?

Password security refers to the practices, technologies, and policies that protect passwords from being stolen, guessed, or misused. It has two main components: user-side practices (creating strong, unique passwords; using password managers; enabling multi-factor authentication) and server-side practices (storing passwords securely using salted hashing; enforcing password policies; detecting breaches). Weak password security is the leading cause of account compromises.

Password Complexity: Length (minimum 12-16 characters, longer is better). Character types (uppercase, lowercase, numbers, symbols). Avoiding common patterns (password, 123456, qwerty).
Password Uniqueness: Never reuse passwords across different sites (prevents credential stuffing). Password managers enable unique passwords per site.
Password Storage: Never store in plain text, always use salted hashing, use slow, memory-hard algorithms (Argon2id, bcrypt).
Multi-Factor Authentication (MFA): Adds second layer of security beyond password (TOTP, hardware key, biometric). Essential for all accounts.

Why Password Security Matters

Passwords are the primary authentication method, and weak passwords are a leading cause of data breaches. Poor password security affects individuals and organizations.

Widespread Password Reuse: 65 percent of people reuse passwords across sites. One breached password compromises multiple accounts. Credential stuffing attacks exploit reuse.
Common Weak Passwords: "123456", "password", "qwerty" are still top passwords. Hackers can guess these instantly (dictionary attacks).
Data Breach Impact: Stolen password databases can be cracked offline. Fast hash functions (MD5, SHA-1) are cracked in seconds. Organizations face fines, reputation damage, customer loss.
Brute Force Attacks: Attackers try millions of password combinations per second. Short passwords (<8 characters) are cracked quickly. Rate limiting and lockouts help but don't prevent offline cracking.

Password cracking time estimates (offline, 2024):

Password Length   Complexity              Cracking Time (8 GPUs)
─────────────────────────────────────────────────────────────────────────────
6 characters      Lowercase only           Instant
6 characters      Full ASCII              Seconds
8 characters      Lowercase only           Minutes
8 characters      Full ASCII              Days
10 characters     Lowercase only           Months
10 characters     Full ASCII              Centuries
12 characters     Lowercase only           Centuries
12 characters     Full ASCII              Millions of years

Note: These assume bcrypt (cost=10). Without bcrypt (MD5), times are microseconds.
Always use slow, memory-hard hash functions (Argon2id, bcrypt).

Common Password Attacks

Attack	Description	Defense
Phishing	Fake login page stealing credentials	MFA, password managers, user education
Credential Stuffing	Reuse stolen password pairs across sites	Unique passwords per site (password manager)
Brute Force	Try all possible password combinations	Long passwords, rate limiting, lockouts
Dictionary Attack	Try common words and patterns	Avoid dictionary words, long random passwords
Keylogging	Capture keystrokes via malware	Antivirus, password manager (auto-fill)
Man-in-the-Middle	Intercept password during transmission	TLS/HTTPS, certificate validation
Offline Cracking	Crack stolen password hashes	Salted hashing, slow algorithms (Argon2id)

Creating Strong Passwords

Strong password formula:

Method 1: Random String (Password Manager)
  • 16-20 random characters
  • Mixed case + numbers + symbols
  • Example: "k9#mP2$qL8&vR4@xW7"

Method 2: Passphrase (Memorable, longer)
  • 4-6 random words
  • Length > 20 characters
  • Example: "correct-horse-battery-staple" (XKCD)
  • Add random numbers/symbols: "correct-horse-42-battery!"

Method 3: Acronym from sentence
  • Sentence: "My first car was a red Toyota Camry from 2010"
  • Password: "Mfcwa rTCf2010" (12+ characters)

Avoid:
  • Dictionary words ("password", "admin")
  • Personal info (name, birthdate, pet)
  • Keyboard patterns ("qwerty", "123456")
  • Sequences ("abc123", "passw0rd")

Password Managers

Password managers generate and store strong, unique passwords for every site. The user only needs to remember one master password. They help prevent credential stuffing and eliminate password reuse. Many include breach monitoring (alert if credentials exposed).

Password manager features:

Essential Features:
  • Secure encryption (AES-256)
  • Zero-knowledge architecture
  • Cross-platform sync (phone, laptop)
  • Password generator (random, configurable)
  • Auto-fill (prevents phishing)
  • Breach monitoring

Recommended Password Managers:
  • Bitwarden (open source, free tier)
  • 1Password (polished, family plans)
  • Apple Keychain (iOS/macOS users)
  • Google Password Manager (Chrome/Android)
  • Keepass (offline, power users)

Secure Password Storage (Server-Side)

Never store passwords in plain text. Always use salted hashing with slow, memory-hard algorithms.

Password hashing best practices:

Algorithm Recommendation:
  • Argon2id (best, winner of Password Hashing Competition)
  • bcrypt (good, widely supported, cost ≥ 12)
  • PBKDF2 (acceptable, NIST standard, iterations ≥ 310,000)
  • scrypt (good, memory-hard)

NEVER use:
  • MD5 (broken, fast)
  • SHA-1 (broken, fast)
  • SHA-256 (too fast for passwords, use with salt + iterations)
  • Plain text (obviously)

Salting:
  • 16+ byte random salt per password
  • Unique per password
  • Store with hash (not secret)

Work Factor:
  • Target 0.1-0.5 seconds per hash
  • bcrypt cost: 12 (10 is minimum)
  • Argon2id: memory=64MB, iterations=3, parallelism=4

Example (bcrypt, Node.js):

const bcrypt = require('bcrypt');

// Hashing
const saltRounds = 12;
const plainPassword = 'user_input';
const hash = await bcrypt.hash(plainPassword, saltRounds);
// Store hash in database

// Verification
const isMatch = await bcrypt.compare(plainPassword, storedHash);
if (isMatch) {
    // Password correct
}

Example (Argon2id, Python):

from argon2 import PasswordHasher
ph = PasswordHasher(
    time_cost=3,      # iterations
    memory_cost=65536,# 64MB
    parallelism=4     # threads
)

# Hashing
hash = ph.hash("user_password")
# Store hash in database

# Verification
try:
    ph.verify(stored_hash, "user_password")
    if ph.check_needs_rehash(stored_hash):
        # Upgrade hash (re-hash with new params)
        new_hash = ph.hash("user_password")
except:
    # Password incorrect

Password Security Anti-Patterns

Complexity Rules That Backfire: Requirements like must include uppercase, number, symbol lead to predictable patterns ("Password1!", "P@ssw0rd"). Users write passwords down or reuse them. Better: length minimum (12+ characters) and check against breach databases.
Regular Password Expiration: Users make minor changes ("Password1" → "Password2") which are easy to guess. Frequent changes lead to weaker passwords. Remove expiration unless there's evidence of compromise. Use breach detection instead.
Password Hints: Hints often give away password ("favorite pet" → "Fluffy"). Attackers can guess hint answers. Disable password hints (or only allow system-generated hints).
Storing Passwords in Reversible Format (Encryption): Encrypted passwords can be decrypted (key compromise = all passwords leaked). Use one-way salted hashing (cannot be reversed). Encryption is only acceptable for systems that need original password (rare).
Not Using Salt: Unsalted hashes allow precomputed rainbow tables, same passwords produce same hash (attackers crack all at once). Always use unique salt per password.
Using Fast Hash Functions (MD5, SHA): Attackers can try billions of guesses per second. Use slow, memory-hard functions (Argon2id, bcrypt).

Password policy checklist:

User-Facing Policy:
□ Minimum length 12 characters (prefer 16)
□ No complexity requirements (let users choose)
□ Block breached passwords (check HaveIBeenPwned)
□ No regular expiration (unless compromise)
□ Support password managers (long paste allowed)
□ Require MFA for all accounts

Server-Side Storage:
□ Argon2id or bcrypt (cost ≥ 12)
□ Unique 16+ byte salt per password
□ No plain text, no reversible encryption
□ Rate limit login attempts (5-10 tries)
□ Log failed attempts (detect brute force)

Additional Controls:
□ Breach monitoring (alert users)
□ Password strength meter (client-side)
□ Multi-factor authentication enforcement
□ Session management (re-authenticate for sensitive actions)