Passwords: generation, strength and useful policies

Password security is less about forcing symbols into a short string and more about length, uniqueness and safe handling.

Prefer long, unique passwords

Reused passwords turn a breach on one service into a risk for another. Password managers make unique credentials practical. For generated secrets, use the password generator; the strength checker can help explain weaknesses but should not be treated as a guarantee.

Policies should help users

A useful policy encourages sufficient length, allows password managers and avoids arbitrary rules that lead to predictable substitutions. The password policy generator can provide a baseline. Blocking known-compromised passwords is often more useful than demanding frequent scheduled changes without evidence of compromise.

MFA and passkeys complement passwords

Multi-factor authentication reduces the impact of a stolen password. Passkeys can remove shared password secrets from the login flow altogether where supported. These mechanisms complement account recovery and authorization design rather than replacing them.

Servers must not store plaintext passwords

Passwords should be processed with a dedicated password-hashing function designed to be slow and configurable, with a unique salt. General-purpose fast hashes such as SHA-256 are useful for file integrity but are not a password-storage scheme by themselves.

Strength is not the whole account

Protect reset flows, session cookies and privileged actions. Rate limiting and monitoring can reduce online guessing, while authorization remains necessary after successful login. Continue with hashes and integrity to understand why hashing and encryption solve different problems.

For server-side password derivation and the distinction between encryption, hashes and MACs, continue with encryption, hashing and HMAC.