Passwords, Hashing and Multi-Factor Authentication

Credentials are the keys to every account, which makes them the most attacked asset on the internet. This lesson covers how to store passwords correctly as a developer, how to choose them wisely as a user, and why multi-factor authentication changes the game.

Why You Never Store Plain Passwords

If your database is ever leaked, and you should assume one day it might be, plaintext passwords hand attackers every account instantly, including accounts reused on other sites. Encrypting passwords is also wrong: encryption is reversible, and the decryption key sits on the same servers. The correct tool is a one-way cryptographic hash.

Hashing Done Right

A hash function turns any input into a fixed-length digest that cannot be reversed. But not all hashes are suitable for passwords. Fast hashes such as MD5 and SHA-256 can be guessed at billions of attempts per second on modern GPUs. Password storage needs three properties:

Slow by design: algorithms like bcrypt, scrypt and Argon2 include a cost factor that makes each guess expensive.
Salted: a unique random salt per user is mixed into the hash, so identical passwords produce different digests and precomputed rainbow tables become useless.
Tunable: as hardware speeds up, you raise the cost factor.

javascript

// Secure password storage with bcrypt (Node.js)
const bcrypt = require('bcrypt');

async function registerUser(email, password) {
  const hash = await bcrypt.hash(password, 12); // cost factor 12, salt built in
  await db.users.insert({ email, passwordHash: hash });
}

async function verifyLogin(email, password) {
  const user = await db.users.findOne({ email });
  if (!user) return false;
  return bcrypt.compare(password, user.passwordHash); // constant-time compare
}

Note that bcrypt generates and embeds the salt automatically, and bcrypt.compare avoids timing side channels. Never write your own comparison with === on secrets.

Password Policy That Actually Helps

Modern guidance from NIST has moved away from forced complexity rules and mandatory 90-day rotations, which push users toward predictable patterns like Summer2026!. Better practice:

Require length (at least 12 characters) rather than symbol soup; passphrases like correct-horse-battery-staple are strong and memorable.
Check new passwords against known-breached password lists and reject matches.
Never truncate or limit passwords to short maximums.
Encourage password managers, which make unique passwords per site practical.

Multi-Factor Authentication

MFA requires two or more of: something you know (password), something you have (phone, hardware key), something you are (fingerprint). Even a perfect phishing attack that captures a password fails if a second factor is required. Options ranked roughly by strength:

SMS codes: better than nothing, but vulnerable to SIM-swap attacks.
TOTP apps (authenticator apps generating 6-digit codes): strong and free to implement with standard libraries.
Hardware keys and passkeys (FIDO2/WebAuthn): phishing-resistant, because the credential is bound to the genuine domain and cannot be replayed on a fake site.

As a developer, offering TOTP is often a single library away, and passkey support is now built into all major browsers and platforms.

Handling Credentials in Your Code

Never commit secrets to version control; use environment variables or a secrets manager.
Log authentication events, but never log passwords, tokens or full session identifiers.
Expire and rotate session tokens, and invalidate them on password change.
Use generic error messages ('invalid email or password') so attackers cannot enumerate which emails exist.

Key Takeaways

Store only salted, slow hashes of passwords using bcrypt, scrypt or Argon2, never plaintext or fast hashes.
Favor long passphrases and breached-password checks over complexity theater.
MFA, especially TOTP and passkeys, neutralizes most credential theft.
Keep secrets out of code, logs and error messages.

Next lesson: How HTTPS and TLS Keep You Safe, where we follow a credential's journey across the network.