New posts in Passwords

How to properly create a password reset token?

Generating a PIN from cryptographic bytes

Are randomly-generated passwords starting with "a" less secure?

Isn't "Dave's protocol" good if only the database, and not the code, is leaked?

Does putting salt first make it easier for attacker to bruteforce the hash?

Is using haveibeenpwned to validate password strength rational?

How can a company tell if my password is similar to the previous 5 passwords?

Website returning plaintext password

Selecting a secure PIN for building access

Does password expiry provide any benefit at all (when using randomly generated passwords)?