Lesson 6 of 6

Secure Password Policies

Effective password policies balance security with usability — overly restrictive policies often backfire by causing users to write passwords down or use predictable patterns. You will learn evidence-based password policy recommendations from NIST SP 800-63B, how to implement multi-factor authentication, and how password managers solve the human memory problem. This lesson bridges the gap between attacking passwords and defending against those attacks.

Learning Objectives — Deep Dive

Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.

0/4

In plain English

This is asking you to build a clear mental model of the concept — not just memorize a definition, but genuinely understand what it means, why it exists, and how it connects to everything else you are learning. When you can explain "a strong password policy" in your own words to someone who has never heard of it, you have truly learned it.

Why this matters

Weak passwords are still the number one cause of data breaches worldwide. Understanding how passwords are stored, attacked, and defended lets you build systems that are genuinely hard to compromise — and helps you advise clients on real password policies that actually work.

Real-world analogy

Think of it like learning to drive. You do not need to understand how the engine works to drive safely, but knowing the basics helps you diagnose problems and avoid mistakes that could cause accidents. The same principle applies here — foundational knowledge prevents costly errors.

What you will be able to do

Audit password policies for an organization, demonstrate the risk of weak passwords using controlled testing, and recommend specific, practical improvements that actually reduce risk without making the system unusable.

Beginner tip

Do not try to memorize everything at once. Read through the material once to get the big picture, then go back and work through the lab. The hands-on practice is what makes the concepts stick — passive reading alone will not get you there.

Secure Password Policies · Objective 1 of 4

VIDEO

Loading video…

Evaluate a password policy

Review a sample password policy and identify its weaknesses using the NIST SP 800-63B guidelines (available at pages.nist.gov/800-63-3/sp800-63b.html). NIST's current recommendations are a significant departure from older advice: require a minimum length of 8 characters (12+ recommended), allow all printable ASCII and Unicode characters, check passwords against a list of known compromised passwords, and do NOT require periodic rotation or mandatory complexity rules (uppercase + number + symbol). Mandatory complexity rules actually reduce security because users respond with predictable patterns like 'Password1!' that satisfy the rules while being easy to crack.

Calculate password entropy

Calculate the entropy of a password using the formula: entropy = log2(charset_size ^ length) = length * log2(charset_size). A random 8-character password from lowercase letters has 8 * log2(26) = 37.6 bits of entropy. A random 12-character password from all 95 printable ASCII characters has 12 * log2(95) = 78.8 bits of entropy. NIST recommends targeting at least 80 bits of entropy for high-value accounts. However, entropy calculations assume truly random passwords — human-chosen passwords have far less effective entropy because people use predictable patterns, dictionary words, and personal information. A passphrase of four random common words (correct-horse-battery-staple) has higher entropy and is easier to remember than a complex 8-character password.

Check against breach databases

Use the Have I Been Pwned (HIBP) API to check whether a password appears in known data breaches without sending the actual password. The API uses k-anonymity: hash the password with SHA-1, send only the first 5 characters of the hash to the API, and the API returns all hashes starting with those 5 characters — you then check locally whether your full hash is in the returned list. Run 'curl https://api.pwnedpasswords.com/range/5BAA6' to see all SHA-1 hashes starting with '5BAA6' (the prefix of the SHA-1 hash of 'password'). Integrate this check into your registration and password-change flows to prevent users from choosing known-compromised passwords.

Implement MFA

Multi-factor authentication (MFA) is the single most effective control against credential-based attacks — even a cracked password is useless if the attacker cannot provide the second factor. The three factor categories are something you know (password), something you have (TOTP app, hardware key), and something you are (biometric). TOTP (Time-based One-Time Password) apps like Google Authenticator and Authy generate a 6-digit code that changes every 30 seconds based on a shared secret and the current time. Implement TOTP in your application using a library such as 'speakeasy' for Node.js or 'pyotp' for Python — both handle the RFC 6238 standard and QR code generation for enrollment. Prioritize MFA on administrative accounts, email accounts, and any account with access to sensitive data.

Previous: Rainbow Table Attacks Course Complete