What Is Password Security? Attacks, Best Practices, and MFA

What Is Password Security?

Password security encompasses the practices, policies, and technologies used to create, store, and protect passwords — and to authenticate users reliably. Despite decades of attempts to replace them, passwords remain the most common form of authentication, and compromised credentials are the leading cause of data breaches worldwide.

How Password Attacks Work

Understanding how attackers crack passwords is essential for building effective defences.

1. Brute Force Attack

The attacker tries every possible combination of characters until the correct password is found.

Trying: a, b, c ... z, aa, ab ... zzz ... aaa000 ... password

• Effective against short passwords
• Tools: Hashcat, John the Ripper
• An 8-character password using only lowercase letters: 26^8 = ~208 billion combinations
• A modern GPU cracks this in minutes offline

2. Dictionary Attack

Instead of every combination, the attacker tries a list of common words and passwords — dictionary files containing millions of entries.

password, Password1, p@ssword, 123456, qwerty, iloveyou, admin123...

Most people use predictable passwords. Dictionary attacks crack the majority of weak passwords almost instantly.

3. Credential Stuffing

Using usernames and passwords leaked from one breach to attempt login on other services. Works because people reuse passwords across sites.

Breach: social_media.com leaked 50 million username:password pairs
Attack: Try all 50 million combinations on banking, email, and work systems

This is why password reuse is catastrophically dangerous.

4. Password Spraying

Instead of many passwords against one account (which triggers lockout), the attacker tries one common password against many accounts.

Try "Password1!" against 10,000 accounts → avoid lockout → move on

Effective against organisations with weak password policies.

5. Phishing

The simplest attack: trick the user into typing their password on a fake login page. No cracking needed.

6. Keylogging

malware records every keystroke typed on the keyboard, capturing passwords as the user types them.

7. Pass the Hash

Instead of cracking the password, attackers steal the hashed password from memory (e.g. via Mimikatz on Windows) and authenticate with the hash-cryptographic-hash-functions-explained) directly.

How Passwords Are Stored (and Why It Matters)

Properly implemented systems never store passwords in plaintext. They store a hash-cryptographic-hash-functions-explained) — the output of a one-way cryptographic function.

bcrypt("mypassword", salt) → $2b$12$K7xfD.pFzB0k...  (stored in DB)

hashing-cryptographic-hash-functions-explained) vs encryption:

• hashing-cryptographic-hash-functions-explained) is one-way — the original password cannot be recovered from the hash
• encryption is reversible — not suitable for passwords

Password Hashing Algorithms

| Algorithm | Status | Notes | |-----------|--------|-------| | bcrypt | Recommended | Slow by design; built-in salting | | Argon2 | Recommended | Winner of password [hashing-cryptographic-hash-functions-explained)](/learning-center/what-is-sha-cryptographic-hash-functions-explained) Competition | | scrypt | Recommended | Memory-hard; resistant to GPU attacks | | MD5 | Broken | Never use for passwords | | [SHA-1](/learning-center/what-is-sha-cryptographic-hash-functions-explained) | Broken | Never use for passwords | | [SHA-256](/learning-center/what-is-sha-cryptographic-hash-functions-explained) (unsalted) | Weak | Fast hash — rainbow tables defeat it |

Salting: A random value added to each password before hashing-cryptographic-hash-functions-explained). Prevents rainbow table attacks and ensures identical passwords produce different hashes.

What Makes a Strong Password?

The NIST Guidelines (2024)

The US National Institute of Standards and Technology now recommends:

• Length over complexity — a 16+ character passphrase beats a complex 8-character password
• No mandatory complexity rules (uppercase, numbers, symbols) — they lead to predictable patterns
• No mandatory periodic resets — forced changes create weaker passwords
• Check against breach databases — reject passwords that have appeared in known breaches
• No password hints

Passphrase Approach

Weak:  P@ssw0rd1!    (8 chars, predictable substitutions)
Strong: correct-horse-battery-staple  (4 random words, easy to remember, very hard to crack)

A 4-word passphrase from a 2,000-word vocabulary has 2000^4 = 16 trillion combinations.

Password Managers

A password manager generates and stores unique, complex passwords for every site. You only remember one master password.

Benefits:

• Every site gets a unique, random 20+ character password
• No reuse — one breach does not cascade
• Auto-fills correctly on legitimate sites (will not auto-fill on phishing pages)
• Syncs across devices

Reputable options: Bitwarden (open source), 1Password, Dashlane, KeePass (offline)

Multi-Factor Authentication (MFA)

MFA-explained) requires a second proof of identity beyond the password. Even if an attacker has the correct password, they cannot log in without the second factor.

MFA Factor Types

| Type | Examples | Strength | |------|---------|---------| | Something you know | Password, PIN | Weakest alone | | Something you have | authenticator app-explained)-and-2fa-explained), hardware key | Strong | | Something you are | Fingerprint, Face ID | Strong |

MFA Methods (Strongest to Weakest)

1. FIDO2-explained)-and-2fa-explained) / Passkeys — phishing-resistant hardware or biometric authentication. Cannot be phished.
2. Hardware security keys (YubiKey-explained)-and-2fa-explained)) — physical device; highly resistant to phishing
3. TOTP-explained)-and-2fa-explained) authenticator apps (Google Authenticator, Authy, Microsoft Authenticator) — time-based codes
4. SMS OTP — weakest MFA-explained); vulnerable to SIM swapping

> SMS MFA-explained) is better than no MFA — but upgrade to an authenticator app wherever possible.

Password Policy Best Practices for Organisations

| Policy | Recommendation | |--------|---------------| | Minimum length | 12–16 characters | | Complexity | Encourage length; do not mandate symbols | | Rotation | Only when compromise is suspected, not on a timer | | MFA-explained) | Mandatory for all accounts | | Breach checking | Reject passwords found in Have I Been Pwned | | Account lockout | Lock after 5–10 failed attempts | | Privileged accounts | Unique passwords + hardware MFA-explained) + PAM solution |

Quick Recap

• Credential stuffing, dictionary attacks, and phishing are the most common password attacks
• Use a password manager — every site needs a unique, strong password
• Always enable MFA-explained) — it stops the vast majority of account takeover attempts
• Passwords should be hashed with bcrypt or Argon2, never stored in plaintext
• Length beats complexity — a 16-character passphrase is stronger than a complex 8-character password