How to Create Strong Passwords: A Developer's Security Guide

What Makes a Password Strong: Entropy

Password strength is measured in bits of entropy — the base-2 logarithm of the number of possible passwords given the character set and length. More entropy = exponentially harder to crack.

* Assumes 10 billion hashes/second (GPU cluster). bcrypt/Argon2 slow this down by orders of magnitude.

NIST Password Guidelines (2024 Update)

NIST SP 800-63B is the authoritative source for password policy. The 2024 update dropped several outdated requirements and added new ones:

How to Store Passwords Securely

The rule is simple: never store a reversible representation of a password. Use a slow, salted hashing algorithm. The salt ensures identical passwords hash differently, defeating rainbow table attacks.

import argon2 from 'argon2';

// Hash on registration
const hash = await argon2.hash(password, {
  type: argon2.argon2id,
  memoryCost: 65536,  // 64 MiB
  timeCost: 3,        // 3 iterations
  parallelism: 4,
});

// Verify on login
const isValid = await argon2.verify(hash, inputPassword);

import bcrypt from 'bcrypt';

const COST_FACTOR = 12; // ~250ms on modern hardware

// Hash on registration
const hash = await bcrypt.hash(password, COST_FACTOR);

// Verify on login
const isValid = await bcrypt.compare(inputPassword, hash);

⚠️ Never use: MD5, SHA-1, SHA-256, or any fast hash for passwords — even with a salt.

Generating Cryptographically Secure Passwords

Use the platform's cryptographic random number generator, never Math.random().

// Browser / Node.js (Web Crypto API)
function generatePassword(length = 20, charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*') {
  const bytes = crypto.getRandomValues(new Uint8Array(length));
  return Array.from(bytes, (b) => charset[b % charset.length]).join('');
}

// Node.js (crypto module)
import crypto from 'crypto';
const password = crypto.randomBytes(32).toString('base64url').slice(0, 24);

Password Security Checklist

1. Hash passwords with Argon2id or bcrypt (cost ≥ 10)
2. Never log, transmit, or store plain-text passwords
3. Use HTTPS everywhere — passwords travel over TLS only
4. Check new passwords against Have I Been Pwned (k-anonymity API preserves privacy)
5. Implement rate limiting and account lockout on login endpoints
6. Add TOTP-based 2FA as an option for all accounts
7. Store the cost factor in the hash string so you can upgrade it later without invalidating existing passwords