Password security is one of the most critical aspects of application security. A single breach can expose millions of user credentials. This guide covers modern best practices for developers handling passwords.
Never Store Plaintext Passwords
The golden rule: never store passwords as plain text. Always hash passwords before storing them. If your database is compromised, hashed passwords are significantly harder to exploit.
Choosing a Hashing Algorithm
Recommended Algorithms (in order of preference)
Argon2id — the winner of the Password Hashing Competition (2015). Resistant to both GPU and side-channel attacks. The current gold standard.
bcrypt — battle-tested since 1999. Uses adaptive cost factor that can be increased as hardware gets faster. Excellent choice if Argon2 isn't available.
scrypt — memory-hard function designed to be expensive on custom hardware (ASICs/FPGAs). Good alternative to bcrypt.
Avoid These
MD5 — fast and broken. Can be cracked in secondsSHA-1/SHA-256 — cryptographically strong but too fast for passwords. GPU rigs can compute billions of SHA-256 hashes per secondPlain SHA with salt — still too fast without a work factor
Salting
A salt is a random value added to the password before hashing. It ensures that:
Identical passwords produce different hashesRainbow table attacks become impracticalEach password must be attacked individually
Best practices for salts:
Generate a unique salt per user (not a global salt)Use a cryptographically secure random number generatorStore the salt alongside the hash (bcrypt and Argon2 do this automatically)Salt should be at least 16 bytes long
Password Requirements
Modern guidelines from NIST (SP 800-63B):
Minimum 8 characters (12+ recommended)Maximum at least 64 characters — don't limit passwords unnecessarilyAllow all characters — including spaces and UnicodeDon't require complexity rules (uppercase + number + symbol) — they often lead to weaker passwords like P@ssw0rd!Check against breached password lists (like Have I Been Pwned)Don't force periodic password changes unless there's evidence of compromise
Multi-Factor Authentication (MFA)
Passwords alone aren't enough. Implement MFA as a second layer:
TOTP (Time-based One-Time Password) — Google Authenticator, AuthyWebAuthn/FIDO2 — hardware security keys, passkeysSMS codes — better than nothing, but vulnerable to SIM swapping
Rate Limiting and Account Lockout
Implement progressive delays after failed attemptsLock accounts temporarily after 5-10 failuresUse CAPTCHA after multiple failed attemptsLog and alert on suspicious authentication patterns
Generate strong passwords with our Password Generator.
