This lesson's interactive features are locked, please to keep using them
Password Review
It's a really bad idea for users to reuse the same passwords across sites. If someone figures out their password for one site, they can try it on other sites. If they get lucky, they can log in to and compromise many of their accounts.
Unfortunately, it's very common for users to reuse passwords. We can't force users to not reuse passwords on the server side, but we can take steps to make it harder for them to reuse passwords. Namely, we can require that passwords are strong.
Passwords Should Be Strong
The most important factor for the strength of a password is its entropy. Entropy is a measure of how many possible combinations of characters there are in a string. To put it simply:
- The longer the password the better
- Special characters and capitals should always be allowed
- Special characters and capitals aren't as important as length
Passwords Should Never Be Stored in Plain Text
The most critical thing we can do to protect our users' passwords is to never store them in plain text. We should use cryptographically strong key derivation functions (which are a special class of hash functions) to store passwords in a way that prevents them from being read by anyone who gets access to your database.