Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Review password security in this order: how passwords are stored, how users choose them, how compromised passwords are blocked, how login attacks are throttled, how recovery and sessions work, and whether high-risk accounts have stronger authentication. Treat each item as a control to verify in code, configuration, logs, and user-flow tests—not as a policy statement to take on trust.
What should a developer password audit cover?
A password audit should test the whole lifecycle, not just the sign-up form. A strong password policy cannot compensate for plaintext storage, and a strong hash cannot stop an attacker using stolen credentials against the live login page.
As an Amazon Associate I earn from qualifying purchases.
- Inspect password storage and any migration path for existing credentials.
- Test password length, character handling, and password-manager compatibility.
- Verify that weak and known-compromised passwords are rejected.
- Test defenses against guessing, spraying, and credential stuffing.
- Review password resets, account recovery, sessions, and security notifications.
- Assess MFA and phishing-resistant authentication for privileged or high-impact accounts.
For each control, record what was tested, the relevant implementation or configuration, the result, and any remediation owner. Use code review for server-side handling, configuration review for security settings, log review for attack detection, and user-flow tests for the experience a real account holder encounters.
Define evidence before testing
A useful audit produces evidence another engineer can reproduce. Identify the password-setting endpoint, login endpoint, reset and recovery routes, verifier library, database fields, feature flags, and identity-provider settings. Capture the algorithm and cost parameters from a test environment, then verify that production uses the intended version. Record sample log events with secrets and reset tokens redacted. Map each finding to a threat: offline cracking, online guessing, credential stuffing, phishing, account takeover, or recovery abuse.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Test both ordinary and exceptional paths. Create a new account, change its password, fail login repeatedly, request a reset, complete recovery, enroll an authenticator, lose that authenticator in a test scenario, and sign in from a new device. A control that works only in the happy path is not complete.
How should passwords be stored?
Store passwords as salted, adaptive password hashes—not as plaintext or reversibly encrypted values. The OWASP Password Storage Cheat Sheet says passwords should never be stored in plain text; it also warns that fast general-purpose hashes such as SHA-256 permit rapid guessing and are not suitable password-storage choices.
Recommended Free Tools
Verify the hash design
- Check that the implementation uses a password-specific adaptive algorithm such as Argon2id, bcrypt, scrypt, or PBKDF2.
- Confirm that each password has a unique salt. The salt should be part of the stored verifier data, not a shared value reused for every account.
- Inspect stored records and code paths to ensure the original password cannot be recovered. Reversible encryption is not a substitute for password hashing.
- Reject legacy schemes such as MD5 and SHA-1 for password protection; the UK Information Commissioner’s Office also identifies these as unsuitable.
Look for accidental copies outside the main user table. Passwords can appear in request logging, debug traces, exception payloads, analytics events, queue messages, test fixtures, database exports, or support tools. Confirm that request bodies are filtered before logging and that administrative views cannot display verifier material. A salt is not a secret, but the verifier still deserves access controls and monitoring because an exposed database gives an attacker material for offline guessing.
Check parameters and migration
Document the algorithm, its parameters, and the format or version marker used in each verifier. That information lets the service recognize older records and upgrade them safely. Test the rehash-on-login or password-reset path, and measure service latency before increasing the computational cost: a stronger setting must remain practical for the service under its expected workload.
Migration should handle every account state. A successful login can trigger a rehash when the old marker is detected; a password change or reset should always write the current scheme. Accounts that never return may need a separate reset campaign or a migration deadline, with clear user messaging. Do not silently compare a new hash to an old format without a plan to retire it. Exercise rollback and partial-failure behavior so a timeout during rehash does not leave an account unusable or create two competing verifiers.
Keep password verification within a protected server-side boundary. A hash computed in the browser is not a replacement for the server-side verifier; if the server accepts that client-side hash as the credential, it can become a reusable password-equivalent secret. Client-side code may improve user feedback, but only the server should decide whether authentication succeeds.
Which password rules should sign-up and reset flows enforce?
For passwords used as a single factor, target a minimum of 15 characters. NIST SP 800-63B-4 says verifiers should allow a maximum length of at least 64 characters, spaces, and supported Unicode, and should not impose arbitrary character-composition rules.
Test length and character handling
- Try passwords below and above the minimum, including a long passphrase, spaces, and supported Unicode characters.
- Confirm the full submitted secret is accepted. Silent truncation can make the password the user believes they set differ from the secret the service verifies.
- Document the Unicode normalization policy and apply it consistently when setting and verifying passwords. NIST’s guidance addresses Unicode handling; OWASP’s Authentication Cheat Sheet also recommends allowing Unicode and whitespace in passwords.
- Verify that the effective maximum is at least 64 characters, not merely that the interface accepts a long value before an API, database, or hashing layer truncates it.
Test leading and trailing spaces, repeated spaces, line breaks if the interface permits them, and characters represented by more than one Unicode form. The service should apply one documented normalization policy consistently rather than normalizing at one endpoint and not another. Check that mobile, browser, API, and identity-provider clients send and verify the same bytes. Never trim or transform a secret invisibly after the user submits it.
Remove composition rules that add friction without dependable protection
Do not require a mixture such as one uppercase letter, one lowercase letter, one digit, and one symbol. NIST states: “Verifiers SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.” Such rules can make passwords harder to remember without reliably making them harder to guess.
Support password-manager paste and autofill instead of blocking them, and offer a show-password control so users can choose to check what they entered. These choices reduce avoidable entry errors without weakening the server’s verification controls. Test paste and autofill in the browsers and mobile clients you support; a field that rejects pasted values or uses an incompatible autocomplete attribute pushes users toward weaker, reused credentials.
Free tools Windows power users keep installed
One-click scans. No signup required.
How should an application screen for weak or breached passwords?
Compare the entire candidate password against a blocklist during password creation and change. NIST recommends blocking passwords that are common, expected, service-specific, derived from the user’s information, or known to have appeared in breaches.
Rank #2
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T120. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T120 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-C port : Insert the T120 security key into the USB-C port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
The comparison must cover the complete submitted secret, not only a short prefix or a lowercased fragment. Include common dictionary choices, default passwords, the service name and product terms, usernames and email-derived strings, and values already associated with the account. Keep the blocklist current enough to respond to breach intelligence and observed attacks, and protect the list and lookup service from becoming a source of account information.
When rejecting a candidate, explain that it is common, predictable, or compromised and give the user a useful next step: choose a longer, unique password. Avoid feedback that teaches trivial workarounds, such as appending a predictable suffix to a blocked password. A strength meter that rewards cosmetic substitutions can encourage exactly the patterns an attacker tries first.
Screening is not only a sign-up task. Reassess existing credentials when breach intelligence or malicious activity indicates that a password may be compromised. Require a change when there is evidence of compromise; do not force users to rotate passwords on an arbitrary calendar schedule. NIST says verifiers should not require periodic changes, but should force a change when there is evidence that the authenticator has been compromised.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallHow can developers defend against guessing and credential stuffing?
Rate-limit failed authentication attempts and monitor attack patterns across accounts. NIST SP 800-63B-4 calls for effective rate limiting against online guessing, while the Canadian Centre for Cyber Security recommends MFA and mandates its use in its guidance.
Make throttling useful without making it an easy denial-of-service tool
Test the control against repeated guesses for one account and against attempts spread across many accounts. Graduated delays, CAPTCHA, device or IP signals, and step-up authentication can be combined according to risk. Avoid a design where an attacker can cheaply lock a legitimate user out merely by submitting repeated wrong passwords.
Document the key, window, and response for each limiter. An account-only counter can be abused to lock out a victim; an IP-only counter can be bypassed through a distributed attack or can punish a shared network. Risk-aware controls can combine account, device, network, and velocity signals, with stronger friction after suspicious behavior rather than a permanent lock. Verify that successful authentication, password reset, and administrator-assisted recovery clear or update counters as intended.
Look beyond one account at a time
Password spraying and credential stuffing distribute attempts across accounts or use credentials exposed elsewhere. Review detection and alerting for patterns across the service, including unusual geolocation, device changes, high request velocity, and impossible-travel signals where appropriate. Confirm that operational responders can distinguish a suspicious pattern from an isolated user mistake.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Check that alerts contain enough context to investigate without exposing passwords or reset secrets. Measure whether events arrive quickly enough for a responder to act, whether repeated alerts are grouped, and whether a confirmed incident can trigger a forced reset or step-up challenge. Test attacks against APIs, mobile endpoints, single-sign-on entry points, and alternate login routes; protecting only the main web form leaves an easier path open.
Use generic authentication errors so the login response does not reveal whether an account exists. Keep recovery instructions actionable, but avoid exposing account status through differences in wording or flow that an unauthenticated visitor can observe. Compare status codes, response timing, redirects, and email behavior as well as visible text, because enumeration often leaks through these side channels.
What should password reset, recovery, and session handling do?
Reset and recovery routes can undermine a sound password verifier if their tokens or session behavior are weak. Test the complete flow, including what happens after a successful change and what a user can do if an authenticator is lost.
Inspect reset tokens and links
- Verify that reset tokens have sufficient entropy, expire, and can be used only once.
- Confirm that each token is bound to the intended account and cannot be applied to a different user’s credentials.
- Check that reset tokens do not leak through referrer headers or application, analytics, and proxy logs.
Attempt to reuse a consumed token, use it after expiration, alter its account identifier, and open it in another browser. Check that the token is transmitted only over protected connections and is removed from the address bar or otherwise prevented from persisting in history and third-party referrers. Ensure support staff cannot generate a reset that bypasses the same protections without an auditable, separately authorized process.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- ✅ PROTECT ONLINE ACCOUNTS – A password manager, two-factor security key, and secure communication token in one, OnlyKey can keep your accounts safe even if your computer or a website is compromised. OnlyKey is open source, verified, and trustworthy.
- ✅ UNIVERSALLY SUPPORTED – Works with all websites including Twitter, Facebook, GitHub, and Google. Onlykey supports multiple methods of two-factor authentication including FIDO2 / U2F, Yubico OTP, TOTP, Challenge-response.
- ✅ PORTABLE PROTECTION – Extremely durable, waterproof, and tamper resistant design allows you to take your OnlyKey with you everywhere.
- ✅ PIN PROTECTION – Locking your device means that if this device is stolen, data remains secure, after 10 failed attempts to unlock all data is securely erased.
- ✅ EASY LOG IN – No need to remember multiple passwords because by plugging OnlyKey to your computer, it automatically inputs your username and password. It works with Windows, Mac OS, Linux, or Chromebook, just press a button to login securely!
Revoke access and notify users
After a password reset, account recovery, authenticator loss, or suspected compromise, revoke or rotate relevant sessions. Determine whether existing browser sessions, refresh tokens, API tokens, remembered devices, and active integrations are invalidated or explicitly reviewed. A password change that leaves an attacker’s refresh token alive is not a complete recovery.
Send notifications for password changes, recovery events, and suspicious sign-ins, and provide a clear route for reporting a compromised authenticator. Notifications should identify the event and give the legitimate user a safe action, without placing a reset secret in the message itself. Test delivery failure, duplicate events, localization, and the path for a user who can no longer access the original email or device.
When should an audit require MFA, passkeys, or security keys?
Passwords alone are not phishing-resistant. Review passkeys or other phishing-resistant authenticators for administrators and operations with high impact; treat them as complementary to password storage, blocklists, and online-attack controls rather than replacements for those controls.
Prioritize privileged consoles, billing or payment changes, production deployment, data export, and authenticator-management actions. For each operation, document whether MFA is required at sign-in, again at the point of high impact, or after a risk signal. Verify that an attacker cannot downgrade to a password-only route, bypass the challenge through an alternate API, or enroll a new authenticator after taking over a session.
A physical security key is one option. If a service supports one, verify connector and platform compatibility, enrollment, loss, replacement, and account-recovery procedures before making it a requirement. A YubiKey 5 security key is a physical option with developer SDKs and passkey resources, but the product choice does not remove the need to test USB, NFC, mobile, desktop, browser, and operating-system support. A key that users cannot enroll or recover from safely can create an availability problem even if the authentication method is strong.
Password managers also help users create and use unique credentials, particularly when paste and autofill work reliably. A 2020 Yubico report found that 36 percent of surveyed IT security respondents said their organizations required a password manager. That figure is historical survey context, not a current estimate of adoption; it does not establish what organizations require today. Evaluate a manager by interoperability, administrator controls, recovery options, and the operational cost of supporting users—not by assuming one product fits every deployment.
How do the controls fit together?
Choose and test controls against the threat they address. No single password measure covers offline cracking, online guessing, credential theft, and phishing at once.
| Control | Primary threat addressed | What to verify |
|---|---|---|
| Adaptive salted password hash | Offline cracking after verifier data is exposed | Approved password-hashing algorithm, unique salts, documented parameters, and a migration path |
| Length, input handling, and blocklist | Predictable or already-compromised password choices | Minimum and maximum behavior, full-secret handling, supported characters, and whole-password screening |
| Rate limiting and attack monitoring | Online guessing, password spraying, and credential stuffing | Per-account controls, cross-account detection, useful alerts, and resistance to attacker-triggered lockouts |
| MFA, passkeys, or other phishing-resistant authenticators | Credential theft and phishing, especially for high-risk access | Enrollment, recovery, loss handling, and suitability for the account or operation |
Scope the audit to the deployment: consumer accounts, workforce identities, and privileged accounts have different user flows and recovery consequences. Compare controls by threat coverage, user friction, recovery burden, interoperability with browsers and password managers, observability, and operational cost. A practical audit records both whether a control exists and whether it works in the actual paths users and attackers can reach.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsHow should an audit compare cost and operational trade-offs?
Cost is more than a library license. Adaptive hashing consumes server CPU or memory on every verification, so measure latency and capacity under expected concurrent login and reset traffic before raising parameters. Stronger settings may require capacity planning, queue protection, and a staged rollout. The benefit is greater resistance to offline guessing after a database compromise.
Rate limiting and monitoring add storage, event-processing, alert triage, and incident-response work. CAPTCHA and step-up checks can reduce automated abuse but add user friction and accessibility considerations. Account lockouts may appear cheap to implement while creating support costs and an attacker-controlled denial-of-service path. Compare the operational burden with the accounts and threats in scope.
MFA and security keys introduce enrollment, replacement, loss, help-desk, and recovery procedures. Passkeys may reduce phishing exposure and password-reset volume, but they still require device and account-recovery planning. Password managers can improve credential uniqueness and reduce resets, while blocked paste or autofill creates hidden usability and support costs. Record these trade-offs explicitly rather than selecting a control solely because it is familiar.
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Common audit pitfalls to test directly
- A database field is called a hash, but the value is a fast digest, a reversible ciphertext, or a single shared salt.
- The sign-up page accepts 64 characters, while an API gateway, database column, or hashing wrapper truncates them.
- The UI rejects paste, disables autofill, or hides the show-password option, leading users to choose shorter or reused secrets.
- A blocklist catches public breach values but misses the service name, username-derived choices, and common defaults.
- A per-account lockout protects one target while allowing a distributed spray across thousands of accounts.
- Reset links are single use in the application but remain in analytics or proxy logs.
- A password reset changes the database verifier but leaves refresh tokens, remembered devices, or privileged sessions active.
- MFA is required on the web console but not on an API, mobile flow, recovery route, or authenticator-enrollment endpoint.
- A security-key requirement has no tested replacement or recovery route, leaving legitimate users unable to regain access.
A repeatable audit record
For every finding, capture the control objective, threat, test account or scenario, exact request or user action, observed result, supporting code or configuration, severity, owner, and retest date. Separate a policy claim from an effective control: “MFA enabled” is incomplete unless enrollment, challenge enforcement, recovery, and alternate routes were tested. Re-run the checklist after changes to the verifier library, identity provider, login rate limits, password-reset templates, browser clients, or account-recovery process.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Close the audit with a prioritized plan. Address plaintext or reversible storage first, then outdated hashing and migration gaps, online-attack weaknesses, recovery and session flaws, and finally usability or coverage improvements. Track whether remediation changes user friction, service latency, support volume, and alert quality. The goal is a password system that remains difficult to crack, difficult to attack at scale, and practical for legitimate users.
Frequently Asked Questions
Should a password audit include old accounts created under a legacy hashing scheme?
Yes. Inspect stored verifier formats and exercise the documented upgrade path so legacy records are not left indefinitely on an outdated algorithm. A rehash-on-login approach can update a verifier after a successful authentication, while reset flows cover users who do not return before a migration deadline. Test partial migrations, failed rehashes, and the process for accounts that never sign in.
Can we block only passwords that appear on a public breach list?
That is narrower than NIST’s recommended blocklist. Screening should also catch common and expected choices, service-specific terms, default values, and passwords derived from the user’s account information. Recheck existing credentials when breach intelligence or malicious activity indicates compromise.
Does requiring a symbol make a password safer if we also require a long minimum?
NIST SP 800-63B-4 advises against composition rules such as requiring mixed character types. Its guidance instead emphasizes length, broad character support, and rejecting passwords that are common or compromised. Allow spaces and supported Unicode, and do not silently truncate the submitted secret.
Is a browser-side password hash safe enough if the server never sees the password?
No. If the server accepts that browser-generated value as the credential, the value can be replayed as a password equivalent. Keep password verification inside a protected server-side boundary and use an adaptive, salted password hash there.
How should rate limiting handle a shared office network or a botnet?
Do not rely only on an IP counter or only on an account lockout. Test account, device, network, and velocity signals together, add graduated delays or step-up checks based on risk, and monitor patterns across accounts. The design should slow attackers without allowing them to cheaply lock out a legitimate user.
Should every password reset invalidate every session?
The audit should verify that relevant sessions and tokens are revoked or rotated after a reset, recovery event, authenticator loss, or suspected compromise. Include browser sessions, refresh tokens, API tokens, remembered devices, and integrations in the test scope, and notify the user about the event.
Are passkeys or a YubiKey a replacement for password hashing and rate limits?
No. Phishing-resistant authenticators protect against credential theft and phishing, while adaptive hashing limits offline cracking and throttling limits online guessing. Use them as complementary controls, especially for administrators and high-impact operations, and test enrollment, loss, replacement, and recovery.
Free tools Windows power users keep installed
One-click scans. No signup required.
What should we do when users cannot access their authenticator?
Provide a documented, auditable recovery process that does not silently bypass the security model. Test replacement keys or passkeys, identity verification, session revocation, notifications, and the path for reporting a compromised authenticator. A strong factor without a safe recovery route can become an availability and support problem.
The Bottom Line
Audit passwords as an end-to-end authentication system: use adaptive salted hashing, accept long passphrases without composition rules or truncation, block common and compromised choices, throttle and detect attacks across accounts, secure recovery and sessions, and add phishing-resistant MFA or passkeys where the impact justifies it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
