Passwords
- How I check password strength without fooling myself
Password strength is easy to misunderstand. A password can look complicated but still be weak if it is short or predictable. The Password Strength tool estimates how hard a password may be to guess under stated …
- How I generate random tokens with enough entropy
A good token should be random enough that guessing it is unrealistic. The Token Generator tool helps with the mechanical part, but I still check the result before using it somewhere real.
- How I think about bcrypt when storing passwords
Passwords should not be stored as plain text. If a database leaks, plain text passwords immediately become everyone else’s problem too. For password storage, I want a password hashing function such as bcrypt.