Password Security and Multi-Factor Authentication

The biggest risks

Attackers rarely "hack" passwords by brute force against a good site. They reuse passwords leaked from other breaches (credential stuffing), phish users, or guess weak passwords. So uniqueness matters most.

Good password habits

• Long beats complex: a passphrase of several random words is easier to remember and harder to guess.
• Unique per site: use a password manager such as KeePassXC or another reputable one.
• Check breaches: services like Have I Been Pwned tell you whether an address appeared in known breaches.
• Don't rotate without reason: NIST's authentication guidance (SP 800-63B) advises against forced periodic changes and arbitrary composition rules, and recommends screening new passwords against known-breached lists.

Multi-factor authentication (MFA)

MFA adds a second proof. From strongest to weakest, typical options are:

Turn MFA on first for email, banking, cloud and password-manager accounts; email is the key to every reset link.

For developers

• Store passwords only as salted hashes with a slow algorithm (Argon2id or bcrypt) — never in plain text or fast hashes.
• Rate-limit login attempts and offer MFA (this site supports authenticator-app 2FA under Settings → Security).
• Use secure, random reset tokens — see our Predictable Reset Token challenge.

How cracking works (in a lab)

Offline attacks test guesses against stolen hashes; that is why long unique passwords matter. See John the Ripper and Hashcat — use them only on hashes you own.

Related: web application security fundamentals.