New posts in Passwords

Is a redirect showing the password in plain text a security vulnerability?

What are the security risks of logging the hash of rejected passwords?

How to strike a balance between security policies and practical implementation challenges?

Is there value in changing your password after failed (malicious) login attempts?

How many rounds of hashing is enough for a password manager?

Does replacing a bcrypt hash with an invalid hash result in no possible working password?

Help! My information has been stolen! What do I do now?

How Often Should I Change my Passwords

Pitfalls when rolling your own "show password" functionality

Should I log that a user changed their password?