Password

A password is a secret string of characters that — most often paired with a login or email address — is used to confirm a user's identity and gain access to an account, system or data. It is the oldest and still most common authentication mechanism in computing, based on the "something you know" principle. Its effectiveness depends entirely on two things: the strength of the password itself and how it is stored on the service side.

What password security involves

A well-designed system never stores passwords in plain text. Instead it saves their hash — an irreversible cryptographic digest computed with a special, deliberately slow function (such as bcrypt or Argon2) and enriched with a random "salt" that prevents comparing hashes across accounts. As a result, even a database breach does not reveal passwords directly. On the user's side, password strength is determined by:

• Length — every extra character exponentially increases the number of possible combinations.
• Randomness — no dictionary words, dates or obvious patterns makes guessing harder.
• Uniqueness — a different password per service limits the fallout of a single leak.

The biggest threats are brute-force and dictionary attacks (mass guessing), phishing (tricking the user into revealing the password) and keyloggers that capture keystrokes.

Passwords in practice

Secure password management rests on a few habits:

1. A password manager — generates and stores long, unique passwords so you don't have to memorize them.
2. A second factor — two-factor authentication, e.g. a TOTP code, protects the account even after a password leak.
3. Reacting to breaches — after a given service is compromised, the password should be changed immediately.

For server administrators, a key step is dropping password login in favor of SSH keys, which are far more resistant to remote guessing attacks.