Password Security - Strong Passwords, Passphrases & Password Managers

Learning Objectives

By the end of this tutorial, you will be able to:

• Explain the difference between plaintext storage, hashing, and salting.
• Outline the mechanics of automated password-cracking attacks (Brute force, Dictionary, Rainbow Tables, and Credential Stuffing).
• Perform manual entropy calculations to measure password strength.
• Contrast traditional complex passwords with modern passphrases.
• Implement security best practices for selecting, setting up, and managing a password vault.
• Generate cryptographically secure passphrases using physical dice and Diceware wordlists.

Table of Contents

1. The Foundation of Authentication
2. How Passwords are Stored (Plaintext, Hashing, & Salting)
3. The Hacker's Arsenal: How Passwords are Cracked
4. Traditional Complex Passwords vs. Modern Passphrases
5. The Science of Strength: Password Entropy
6. Step-by-Step: Creating a Diceware Passphrase Using Dice
7. The Solution to Password Fatigue: Password Managers
8. Comprehensive Password Manager Comparison
9. Step-by-Step: Setting Up Your First Password Vault (Bitwarden Guide)
10. Securing the Keys to the Kingdom: Master Password Safety
11. Common Password Myths vs. Facts
12. Hands-On Practice Exercises

1. The Foundation of Authentication

Authentication: The security process of verifying the identity of a user, device, or system before granting access to specific accounts or resources.

Whenever you interact with a computer system, you undergo three processes:

1. Identification: Claiming who you are (e.g., typing your username john_doe).
2. Authentication: Proving you are who you claim to be (e.g., verifying with a password).
3. Authorization: What permissions you have once you are logged in (e.g., viewing your profile).

Passwords are the oldest and most widely used authentication method. They belong to the Knowledge Factor ("Something you know"). Unfortunately, because they are digital assets, passwords can be stolen in bulk from database breaches, guessed by fast computers, or leaked due to bad habits.

2. How Passwords are Stored (Plaintext, Hashing, & Salting)

Hashing & Salting: Cryptographic operations that convert plaintext passwords into unique one-way hash values, augmented with random strings (salts) to secure database records against mass decryption.

To understand password security, you must understand how websites store your credentials on their servers.

Plaintext Storage (The Worst Practice)

Plaintext Storage: The practice of storing credentials in an unencrypted, human-readable text format, making them immediately accessible to anyone who accesses the database.

If a website stores your password exactly as you typed it, it is stored in plaintext.

• If your password is MySecretPassword1!, anyone with database access (system administrators, database managers, or hackers who break in) can read it directly.
• Example: In 2019, Facebook admitted it had accidentally stored hundreds of millions of user passwords in readable plaintext format inside their internal search logs.

Password Hashing (Cryptographic Security)

Password Hashing: The process of using a cryptographic hash function to convert a plaintext password into a fixed-length string of characters (a hash), which is mathematically infeasible to reverse.

Secure websites never store your actual password. Instead, they run your password through a Cryptographic Hash Function and store the resulting fixed-length string (the hash).

Key Hashing Algorithms:

• SHA-256 (Secure Hash Algorithm 256-bit): A cryptographic hash function that generates a unique, fixed-size 256-bit signature. While fast, it is vulnerable to high-speed offline GPU cracking, making it less ideal for password storage without slow key-stretching functions.
• bcrypt: A password-hashing function designed specifically for secure credential storage. It incorporates a configurable "work factor" that makes computing the hash slow, defending against brute-force attacks.
• Argon2: The winner of the 2015 Password Hashing Competition, considered the modern state-of-the-art hashing function. It is memory-hard, meaning it requires significant memory to compute, protecting against ASIC- and GPU-based mass cracking attacks.

[ User Input Password ] ---> [ Hash Function ] ---> [ Stored Hash Value ]
"MySecretPassword"      --->      SHA-256     ---> "5e884898da28047151..."

• One-Way Direction: A hash function is one-way. It is easy to calculate a hash from a password, but mathematically impossible to reverse-engineer the original password from a hash value.
• Deterministic: The same password will always yield the exact same hash. When you log in, the server hashes your input and checks if it matches the stored hash in the database.

Password Salting (Preventing Mass Decryption)

Password Salting: The security practice of appending a unique, random string of characters (a salt) to a password before hashing it, ensuring that identical passwords result in completely different hashes.

If two users choose the same password (e.g., 123456), their hashes will be identical. Hackers can exploit this by pre-computing hashes for millions of common passwords (called a Rainbow Table) and comparing them to a stolen database to crack thousands of passwords instantly.

To prevent this, databases use Salting. A salt is a unique, random string of characters added to each user's password before it is hashed.

User A: Password ("hello") + Salt ("xyz789") ---> Hash Value A ("8a76d8b...")
User B: Password ("hello") + Salt ("abc123") ---> Hash Value B ("2e9b10c...")

Even though User A and User B have the exact same password, their stored hashes are completely different because their salts are different. This forces hackers to crack each password individually, taking much longer.

3. The Hacker's Arsenal: How Passwords are Cracked

Password Cracking: The systematic recovery of passwords from stored hashes or transmission payloads using dictionary databases, heuristic rules, and raw computation.

Hackers use automated programs to scan databases and guess passwords. Here is a breakdown of their primary concepts and tools:

A. Online vs. Offline Cracking

• Online Attack:

  Online Attack: A credential-cracking attempt where the attacker submits login requests directly to the target system's active network port or authentication API, subject to rate limiting and account locking.

  The hacker tries to log in on the actual website (e.g., trying to log in at gmail.com). Websites block this by locking the account after 5 wrong attempts or adding CAPTCHAs.

• Offline Attack:

  Offline Attack: A cracking method where an attacker obtains the encrypted/hashed credential database from a system breach and runs guessing algorithms locally on their own hardware, completely bypassing network locks or speed limits.

  The hacker steals the hashed database from a website breach. They copy it to their own high-powered computers and run password cracking software (like Hashcat or John the Ripper) locally. They can guess trillions of passwords per second because there is no server to block them.

B. GPU Cracking Speed

Graphics Processing Unit (GPU): A specialized electronic circuit designed to rapidly manipulate and alter memory to accelerate parallel computations. Hackers leverage the massive parallel-processing power of GPUs to run password cracking software.

Modern graphics cards (GPUs) are designed to perform simple math calculations on millions of pixels simultaneously. Hackers use these same GPUs to hash guesses.

• A single high-end consumer GPU (like an NVIDIA RTX 4090) can calculate over 150 billion SHA-256 hashes per second.
• If a password is short or uses standard formatting, a cluster of these cards will decrypt it in minutes.

C. Attack Methods

1. Brute-Force Attack:

   Brute-Force Attack: A trial-and-error cracking method where an automated program generates and submits every possible character combination sequentially until the correct one is found.

2. Dictionary Attack:

   Dictionary Attack: A hacking technique that attempts to defeat authentication by testing a precompiled database of words, phrases, and commonly leaked credentials.

3. Hybrid/Rules-Based Attack:

   Hybrid/Rules-Based Attack: An advanced dictionary attack where rules are applied to words (e.g., character substitution like e to 3, or appending years/symbols) to simulate common human password habits.

4. Credential Stuffing:

   Credential Stuffing: An automated attack where hackers use lists of compromised username/password pairs leaked from previous data breaches to gain unauthorized access to accounts on other services.

4. Traditional Complex Passwords vs. Modern Passphrases

Passphrase: A credential composed of multiple random words, designed to maximize length and security while remaining easy to remember.

For decades, we were told to create complex passwords:

• Complex Password:

  Complex Password: A relatively short credential that meets complexity criteria (mixing uppercase, lowercase, numbers, and special characters) but is often highly predictable and hard for humans to remember.

  • Example: Tr0ub4dour&3

  This contains numbers, symbols, uppercase, and lowercase letters. However, it is only 12 characters long. A computer program running dictionary rule-based modifications can crack this in hours. Furthermore, humans cannot remember this without writing it down.

The NIST (National Institute of Standards and Technology) guidelines now promote Passphrases:

NIST (National Institute of Standards and Technology): The physical sciences laboratory and non-regulatory agency of the U.S. Department of Commerce that publishes cybersecurity standards and credential guidelines (such as SP 800-63B).

• Example: correct horse battery staple

This passphrase is 28 characters long. Although it consists only of simple lowercase dictionary words, its extreme length makes it cryptographically superior to the complex password, while being significantly easier for a human to visualize and remember.

       EASY TO REMEMBER      |       HARD TO REMEMBER
      ------------------     |      ------------------
       correct-horse-        |         Tr0ub4dour&3
       battery-staple        |
                             |
       Cracking Time:        |        Cracking Time:
      Millennia (20+ chars)  |        Hours (12 chars)

5. The Science of Strength: Password Entropy

Password Entropy: A mathematical measurement of the uncertainty and computational complexity of a password, expressed in bits.

To understand why length beats complexity, we use Information Entropy, which measures how many guess attempts a hacker would need to exhaust all possibilities.

Entropy ($E$) in bits is calculated as: $$E = N \times \log_2(L)$$

Where:

• $N$ = Password length (number of characters)
• $L$ = Number of possible characters in the set (pool size)

Entropy Formula Variables:

• Password Length ($N$):

  Password Length ($N$): The total count of characters, symbols, and spaces that compose a password.

• Character Pool Size ($L$):

  Character Pool Size ($L$): The total number of unique characters in the character set from which the password characters are chosen (e.g., 26 for lowercase letters).

Character Pool Sizes ($L$)

• Numbers only (0-9): $L = 10$
• Lowercase letters (a-z): $L = 26$
• Mixed letters (a-z, A-Z): $L = 52$
• Alphanumeric (a-z, A-Z, 0-9): $L = 62$
• Full keyboard characters (letters, numbers, symbols): $L = 95$

Calculating Entropy: Complex vs. Long

Let's calculate two passwords:

Scenario A: The Complex Password Pa$$w0rd!

• Length ($N$) = 9
• Pool ($L$) = Full keyboard characters = 95
• $\log_2(95) \approx 6.57$
• Entropy ($E$) = $9 \times 6.57 = \mathbf{59.1\text{ bits}}$

Scenario B: The Simple Passphrase purple monkey yellow carpet

• Length ($N$) = 28 (including spaces)
• Pool ($L$) = Lowercase letters and spaces = 27
• $\log_2(27) \approx 4.75$
• Entropy ($E$) = $28 \times 4.75 = \mathbf{133\text{ bits}}$

What do the bits mean?

• Under 60 bits: Weak. Can be cracked quickly by high-powered consumer hardware.
• 60 - 80 bits: Medium. Safe against average online threats, but vulnerable to offline GPU cluster cracking.
• 80 - 100 bits: Strong. Extremely difficult to crack, taking decades.
• Over 100 bits: Cryptographically secure. Uncrackable using modern physics and computing.

6. Step-by-Step: Creating a Diceware Passphrase Using Dice

Diceware: A method for generating high-entropy passphrases by using physical dice rolls to select random words from a standardized index sheet.

Diceware is a system for generating cryptographically secure, random passphrases. It uses physical dice to select words from a special wordlist.

• Diceware Wordlist:

  Diceware Wordlist: A standardized database containing exactly 7,776 words (matching the $6^5$ combinations of rolling five six-sided dice), designed to maximize passphrase randomness and memory recall.

                    HOW DICEWARE WORKS
+-------------------------------------------------------+
|  1. Roll a standard 6-sided die 5 times.              |
|     Example: You roll a 5, then 2, 4, 3, 1.           |
|                                                       |
|  2. Combine these digits into a 5-digit number.       |
|     Result: 52431                                     |
|                                                       |
|  3. Find this number in the Diceware Wordlist.        |
|     52431 -> "metal"                                  |
|                                                       |
|  4. Repeat this process 4 or 5 times to make a list:  |
|     "metal-truck-winter-jungle-sky"                   |
+-------------------------------------------------------+

Why Use Physical Dice?

Computers are terrible at generating true randomness. They use algorithms that make "pseudo-random" numbers, which can sometimes be predicted. Rolling physical dice relies on physical chaos, which is truly random.

7. The Solution to Password Fatigue: Password Managers

Password Manager: A software application that acts as a secure database vault to generate, encrypt, store, and auto-input credentials across operating systems.

Using unique, 100-bit passphrases for 80 accounts is impossible for a human to manage. This leads to Password Fatigue, causing users to reuse passwords.

• Password Fatigue:

  Password Fatigue: The cognitive overload experienced by users who must manage multiple complex login credentials, which often leads to dangerous behaviors like reusing passwords across services.

A Password Manager is an encrypted software application designed to generate and store secure credentials.

How Encryption Works: Zero-Knowledge

The database (vault) containing your passwords is encrypted using AES-256 (Advanced Encryption Standard).

• AES-256 (Advanced Encryption Standard):

  AES-256: A symmetric-key encryption standard adopted by the U.S. government that uses a 256-bit key size, widely recognized as mathematically secure against brute-force attacks.

• Zero-Knowledge Architecture:

  Zero-Knowledge Architecture: A security system design in which data is encrypted and decrypted locally on the client's device, ensuring that the service provider's servers never possess the keys or plaintext data.

• The decryption key is derived directly from your Master Password using a hashing algorithm (like PBKDF2 or Argon2id) with thousands of iterations.
• This decryption happens locally on your device (in your browser or app).
• When syncing with the cloud, the vault is transmitted as an unreadable scrambled mess. The cloud server never knows your master password or the keys to decrypt your database.

8. Comprehensive Password Manager Comparison

Password Vault Architectures: The system design variations (e.g., local storage, cloud synchronization) that define how vaults protect and sync credentials.

When selecting a manager, evaluate their architecture, security audits, and hosting options:

Types of Vault Architectures:

• Cloud-Based Manager:

  Cloud-Based Manager: A password manager that stores encrypted vaults in a secure cloud database, allowing seamless cross-device synchronization and web access.

• Local-Only (Offline) Manager:

  Local-Only Manager: A password manager that stores the encrypted vault file solely on the local device's filesystem, minimizing network attack surfaces.

• Self-Hostable Manager:

  Self-Hostable Manager: A password manager architecture that allows users to deploy and run their own backend synchronization server (e.g., hosting Bitwarden/Vaultwarden locally or on a private VPS), retaining full custody of data.

9. Step-by-Step: Setting Up Your First Password Vault (Bitwarden Guide)

Vault Setup: The sequence of registration, application installation, and initialization required to deploy a new password manager.

Here is a guide to initializing a vault using Bitwarden:

Step 1: Sign Up

1. Go to the official website: https://bitwarden.com/ (Always verify the URL).
2. Click Get Started and enter your email address.

Step 2: Formulate Your Master Password

Create a master password that is a 4-to-5 word Diceware passphrase.

• Example: jungle-winter-brick-ocean
• Write this down on a physical card and keep it in a safe place. If you lose this, Bitwarden support cannot recover your account.

Step 3: Install Browser Extensions & Apps

1. Go to your browser extension store (Chrome, Firefox, Safari) and search for Bitwarden.
2. Install the extension.
3. Download the app on your mobile device (iOS/Android) and log in.

Step 4: Add a Login Entry

1. Open the Bitwarden extension.
2. Click the + (Add item) button.
3. Select Login type.
4. Input the name (e.g., Google), URI (https://accounts.google.com), your username, and click the Generate Password button to create a random 20-character password.
5. Save the item. Now, when you visit Google, Bitwarden will offer to autofill your credentials automatically.

10. Securing the Keys to the Kingdom: Master Password Safety

Master Password Security: Practical actions and settings to protect the single key that decrypts your entire password vault database.

Your Master Password secures everything. Protect it with these measures:

1. Physical Emergency Sheet: Write your master password on paper. Keep it in a secure, fireproof drawer.
2. Auto-Lock settings: In your password manager settings, set the auto-lock timer.
   • Desktop: Lock after 15 minutes of inactivity.
   • Mobile: Lock immediately when the app is closed, and require Biometrics (Face ID/Fingerprint) to reopen.
3. Vault Backups: Export your encrypted vault database (.json or .csv format) once every few months and save it on a secure offline flash drive.

11. Common Password Myths vs. Facts

Password Hygiene: Practical guidelines and habits designed to maintain strong credential protection and prevent common security errors.

[!NOTE] Myth: My password is secure because I change it every month.
Fact: Frequently changing passwords often leads users to make minor, predictable changes (e.g., Winter2026! to Spring2026!). NIST guidelines advise changing passwords only if there is evidence of a breach.

[!NOTE] Myth: Web browsers (Chrome, Edge, Safari) are the best place to save passwords.
Fact: Browser password storage is less secure than dedicated password managers. If malware infects your computer, it can easily extract saved credentials from browser storage profiles.

12. Hands-On Practice Exercises

Hands-On Exercises: Practical activities designed to help you generate passphrases, calculate entropy, and manage password vaults.

Exercise 1: Roll a Diceware Passphrase

If you don't have physical dice, you can use the EFF's website, but using real dice is best for absolute security:

1. Roll a standard 6-sided die 5 times. Record the numbers (e.g., 2-5-1-4-3).
2. Search the EFF Short Diceware Wordlist for 25143.
3. Repeat this process until you have 4 random words.
4. Connect them using a separator: word1-word2-word3-word4.

Exercise 2: Entropy Calculation Challenge

Calculate the entropy for the following passwords using $E = N \times \log_2(L)$:

1. MyCatLeo! (Lowercase, Uppercase, Symbol. Pool $L = 95$, Length $N = 9$)
2. monkey-guitar-brick-ocean (Lowercase, Hyphen. Pool $L = 27$, Length $N = 26$)

Check your math:

• Password 1: $9 \times 6.57 = 59.13$ bits
• Password 2: $26 \times 4.75 = 123.5$ bits