A password is a secret string that proves you are who you claim to be. It is the oldest and most common authentication method. It is also the weakest. People reuse passwords across sites. They choose words that are easy to remember and easy to guess. They write them on sticky notes and share them with colleagues. Attackers know this. Credential theft is the starting point for most breaches.

Password strength comes from length and unpredictability. A 12-character passphrase made of random words is stronger and easier to remember than an 8-character string of symbols. The problem is not the password itself. It is the system around it. Storing passwords in plaintext is negligent. Storing them with a fast hash is almost as bad. Passwords should be salted and hashed with a slow algorithm like bcrypt or Argon2. Rate limiting blocks brute-force attempts. Breach detection checks new passwords against known leaked lists.

Password best practices

• Use a password manager — generate and store unique passwords
• Length over complexity — longer is better than stranger
• Never reuse — one breach should not cascade
• Enable MFA — a password alone is not enough
• Check for breaches — change compromised passwords immediately

Passwords are not going away soon, but they are no longer sufficient on their own. Treat them as one layer, not the whole defense.