PasswordAuthentication

Password authentication is a method of verifying a user’s identity by requiring a secret string called a password. When a user submits a username and password, the system retrieves the stored credential for that username and compares it to the submitted value. If they match, access is granted; otherwise, it is denied. Transmitted credentials should be protected by encryption, such as TLS, to prevent interception.

Storage typically uses salted cryptographic hashes rather than plaintext passwords. Modern algorithms such as bcrypt, Argon2, or scrypt are deliberately slow to resist brute-force attempts, while unique salts prevent rainbow table attacks. Some designs also use a pepper—an additional secret value stored separately.

Strengths and weaknesses: Password-based authentication is inexpensive and widely supported, but relies on user-chosen secrets that can be weak, reused across sites, or phished. Common attacks include credential stuffing, brute-force attempts, keylogging, phishing, and breaches that expose password hashes.

Security best practices: require long, unique passwords; encourage password managers; implement rate limiting and account lockouts; use TLS for all transmissions; enable multi-factor authentication to add a second factor; prefer passwordless or public-key methods where feasible; store hashes with strong algorithms and salts and monitor for compromises.

Alternatives and related concepts: Multi-factor authentication, public-key cryptography, and hardware tokens (for example FIDO2/WebAuthn) provide stronger protection. In many systems password authentication can be disabled in favor of these methods.

Implementation notes: Password authentication is common in SSH, HTTP basic authentication, and LDAP. In web applications it is often followed by a session or token-based login. Modern recommendations emphasize resilience, such as strong hashing, rate limiting, MFA, and minimizing reliance on passwords alone.