Beginner · Security basics · topic 3 of 43 · 30 min
Passwords and multi-factor authentication
Explanation
Why passwords fail
Authentication means proving who you are. A password is the most common way, and also the most commonly broken. Attackers rarely "hack" a password with magic; they usually get it in boring ways:
- Guessing: trying common passwords like 123456, password or a name plus a year.
- Credential stuffing: trying email and password pairs leaked from one website on many other websites, because people reuse passwords.
- Phishing: tricking you into typing the password into a fake page.
- Brute force: trying many combinations very fast, usually against stolen password hashes.
- Shoulder surfing and sticky notes: simply seeing it.
What makes a password strong
Length matters most. Each extra character multiplies the number of guesses needed. A four-word passphrase like "chai monsoon pakoda balcony" is long, easy to remember and hard to guess. A short password like "P@ssw0rd" looks complex but is in every attacker's word list.
Modern guidance from NIST (SP 800-63B, the US standard many companies follow) says: allow long passwords and passphrases, check new passwords against lists of known breached passwords, and do not force people to change passwords on a fixed schedule unless there is a sign of compromise. Forced changes lead to weak patterns like Summer2025!, Autumn2025!.
- Make it long: aim for 15 or more characters, or a passphrase of four or more random words.
- Make it unique: one password per site, so a leak on one site does not open the others.
- Use a password manager: an app that creates and stores a strong, unique password for every site behind one master passphrase.
Multi-factor authentication (MFA)
A factor is a kind of proof. There are three kinds:
| Factor | Meaning | Examples |
|---|---|---|
| Something you know | A secret in your head | Password, PIN, UPI PIN |
| Something you have | An object you own | Phone with an authenticator app, hardware security key, bank card |
| Something you are | Part of your body | Fingerprint, face |
MFA means using two or more different kinds. A password plus a code from an app on your phone is MFA. Two passwords are not, because both are "something you know".
Not all MFA is equal
- SMS OTP: better than nothing, but OTPs can be phished or redirected by a SIM swap (an attacker convinces a telecom shop to move your number to their SIM).
- Authenticator app codes (TOTP): a six-digit code that changes every 30 seconds, made from a secret shared with the app. Not tied to your SIM, but still can be phished on a fake page.
- Push approval: tap "Approve" on your phone. Attackers send many pushes hoping you tap one (MFA fatigue). Number matching, where you type the number shown on screen, fixes much of this.
- Security keys and passkeys (FIDO2): the strongest common option. They check the website's real address, so they do not work on a fake site. This is called phishing-resistant MFA.
Login attempt for priya@company.example
Factor 1: password ............ OK
Factor 2: authenticator code .. 482913 ... OK
Result: signed inCommon mistakes and fixes
- Reusing one password everywhere. Fix: password manager, unique passwords.
- Sharing OTPs. No real bank, delivery company or government office will ever ask for your OTP or UPI PIN. Fix: never share it, whoever is asking.
- Approving a login prompt you did not start. Fix: deny it and change your password.
- Writing the password on a note stuck to the monitor. Fix: password manager.
- Keeping MFA off on email. Your email resets every other account, so protect it first.
Need help?
Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.
Try:
Watch the lesson
Passwords and multi-factor authentication · 1/7
Passwords are the most common way to prove who you are, and the most commonly broken.
Prefer a video by a teacher? Find free videos on “passwords passkeys multi factor authentication explained” on YouTube ↗
In real life: Credential stuffing after a leak
When a shopping or food website leaks its user list, criminals feed those email and password pairs into tools that try them on email, banking and social media logins. People who reused the password lose those accounts within days. People with unique passwords lose only the one leaked account, and people with MFA usually lose nothing, because the password alone is not enough.
Practice (0/4 done)
Which of these is real multi-factor authentication?
Write strength(password) that returns "weak", "medium" or "strong" using these rules, in order: 1. If the password (in lower case) is in COMMON, or shorter than 8 characters: "weak". 2. If it is 15 characters or longer: "strong" (a long passphrase). 3. If it is 12 or longer AND uses at least 3 of the 4 kinds (lower case, upper case, digit, symbol): "strong". 4. Otherwise: "medium". A symbol is any character that is not a letter or digit (a space counts).
Authenticator apps make codes with HOTP/TOTP (RFC 4226 and RFC 6238). Complete hotp(key, counter) that returns a 6-digit code as a string: 1. msg = the counter packed as 8 bytes, big-endian: struct.pack(">Q", counter) 2. h = hmac.new(key, msg, hashlib.sha1).digest() 3. offset = the last byte of h AND 0x0F 4. number = the 4 bytes of h from offset, as a big-endian int, AND 0x7FFFFFFF 5. return number % 1_000_000 as a string padded with zeros to 6 digits. (A TOTP app uses counter = current Unix time // 30.)
Secure your own accounts: install a reputable password manager, change your email password to a long unique passphrase, and turn on MFA (authenticator app or passkey) for email, your main bank app and one social account.
Quick quiz
Read more (free)
Related help
Before this, learn
This topic builds on these. If something here feels new, open them first.
Related topics
- Phishing and social engineeringSecurity basics · same module
- SSRF and authentication flawsEthical Hacking and Penetration Testing (legal labs) · Web attacks and their fixes
- Security basics: threats, CIA and AAAComputer Networking (CCNA level) · Network security
- Login with Google, OTP and passkeysBackend Development · Authentication and authorization
- Password hashing and cracking (your own hashes only)Ethical Hacking and Penetration Testing (legal labs) · Deeper lab skills: passwords, privilege, Metasploit, wireless
- Signup and login end to endFull-Stack Development · Authentication and files end to end
Questions people ask about this
Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.
Which password is strongest?
Answer: river tiffin kite seventeen lamp
A long passphrase of random words has far more possible combinations and is not in common lists.
What is credential stuffing?
Answer: Trying leaked username and password pairs on other websites
It works because people reuse passwords across sites.
Why are security keys and passkeys called phishing-resistant?
Answer: They check the real website address, so they will not sign in to a fake site
The key is bound to the genuine domain, so a look-alike page gets nothing.
A caller from "your bank" asks for the OTP you just received to "stop a fraud". What do you do?
Answer: Refuse, hang up and call the number on the back of your card
Banks never ask for OTPs. Call back on an official number you find yourself.
What does current NIST guidance say about forcing password changes every 90 days?
Answer: Not recommended unless there is evidence of compromise
Forced changes lead to predictable patterns; change on evidence of compromise instead.
MFA (multi-factor authentication) adds security by…Related
Answer: Requiring a second factor beyond the password
A second factor protects even if the password leaks.
Which login uses two different factors?Related
Answer: A password and a code from a phone app
A password is something you know; the phone app is something you have. A PIN and a password are both something you know.
In the authorization code flow, where does the user type their Google password?Related
Answer: On Google's own page
The user logs in at Google. Your app never sees the Google password.
Even a cracked password matters less when the account has…Related
Answer: Multi-factor authentication
MFA requires a second factor beyond the password.
Pass the quiz (60% or more) or mark this topic as done when you are ready.
Your progress is saved on this device only.
Next steps
- 2 more topics in “Security basics” before its exam: Phishing and social engineering, Ethics and the law: permission first.
- Module 1 exam: Security basics · 13 questions · 20 min, without help. 5 topics of this module still to finish first.
- Then the next module, Networking for security. 43 topics left in the course before the final exam.