perpassword

Perpassword is a concept in information security that describes a design principle where each account or service is protected by a distinct password. The goal is to prevent credential reuse and limit the impact of breaches by ensuring that compromising one password does not automatically compromise other accounts. The term is not a formal standard, but it appears in discussions about password hygiene and management strategies. In practice, perpassword can be implemented through two common approaches: per-service password derivation and centralized password management.

Per-service password derivation relies on a cryptographic key derivation function to generate a unique password for each service from a user-controlled secret and a service identifier. This approach can allow password regeneration without memorization, but typically requires a secure seed or master secret stored in a trusted device or hardware.

Centralized password managers store unique, randomly generated passwords for each service and autofill them in browsers or apps. This approach makes adherence easier for users but shifts trust to the password manager and to the security of its storage and synchronization mechanisms.

Benefits of perpassword include reduced risk from a single compromised password, easier rotation, and improved resistance to credential-stuffing attacks. Limitations include reliance on secure storage or derivation secrets, potential single points of failure, and usability challenges for users without access to the manager or device.

Implementation considerations emphasize strong master secrets, multi-factor authentication for access, and robust cryptographic primitives (for example, slow key derivation functions such as Argon2, scrypt, or bcrypt). Perpassword is compatible with broader password hygiene practices, such as MFA and phishing-resistant authentication.

See also: password manager, credential stuffing, password hygiene, multi-factor authentication, password derivation.