Password

Passwords on shared computers date to MIT's Compatible Time-Sharing System in the early 1960s, and so do the first leaks of password files. Morris and Thompson's "Password Security: A Case History" (1979) described the Unix response that still shapes practice: store only a one-way transformation, make it deliberately slow (crypt(3) iterated a modified DES 25 times), and add a random salt (12 bits then) so identical passwords hash differently and precomputed tables are useless.

Modern storage uses a memory-hard or iterated password hashing function with a unique salt per password. OWASP's Password Storage Cheat Sheet recommends Argon2id, for example with 19 MiB of memory, two iterations and one degree of parallelism; alternatively scrypt with N=2^17, r=8, p=1; bcrypt with a work factor of at least 10, noting its 72-byte input limit; or PBKDF2-HMAC-SHA256 with at least 600,000 iterations where FIPS compliance is required. NIST SP 800-63B-4 §3.1.1.2 requires a salt of at least 32 bits and an approved scheme from SP 800-132, with the cost factor as high as practical. An optional pepper, a secret key held outside the database, for example in an HSM, means a stolen table alone cannot be cracked. Fast general-purpose hashes such as MD5 or plain SHA-256 are unsuitable, because GPUs test billions of candidates per second against them.

The same section reversed decades of folklore on policy. Passwords used as the only factor must be at least 15 characters, and at least 8 when part of multi-factor authentication; verifiers should accept at least 64 characters, all printing ASCII and Unicode, and must not impose composition rules, must not require periodic changes (but must force a change on evidence of compromise), must not use security questions or hints, and must check new passwords against a blocklist of common, expected and compromised values. Paste and password managers should be allowed. Blocklist checks can use a k-anonymity range query, as Have I Been Pwned's Pwned Passwords service does with the first five hex characters of a SHA-1 hash, so the password itself never leaves the server.

Attacks split into online and offline. Online, attackers use password spraying (a few common passwords across many accounts, staying under lockout thresholds) and credential stuffing (pairs leaked elsewhere), countered by rate limiting, which SP 800-63B-4 §3.2.2 caps at 100 consecutive failures per authenticator, and by breached-password checks. Offline, after a database theft, tools such as hashcat apply dictionaries, rules and masks, so the choice of hash function decides how long users have to react. Phishing, adversary-in-the-middle proxies, keyloggers and infostealers bypass strength entirely, which is why passwords are increasingly paired with, or replaced by, phishing-resistant factors such as passkeys.