📖 Programmer's Bible
More to Explore › Staying Safe Online › 1 of 17 · See on the map

Passwords: How Logging In Works

⏱ 6 min read

In one sentence: When you log in, your password travels to the website inside HTTPS; a well-built website keeps only a scrambled "hash" of it, and checks you by comparing hashes.

Why should I care?

You log in many times a day: to email, games, school or shopping websites. Each time, you type a username (the name the website knows you by) and a password (a secret word or phrase that only you should know). Together, they open your account: your own space on that website.

If someone else learns your password, they can open your account too. Knowing what happens after you press "Sign in" explains the usual safety advice.

Analogy

Think of a fingerprint. Two fingerprints can show whether they come from the same finger. But a fingerprint cannot tell you what the person looks like.

A well-built website treats your password, the "finger", the same way. It does not keep the password, only a kind of "fingerprint" of it. When you log in, it makes a fingerprint of what you typed and checks whether the two match.

Where the analogy breaks down: a real fingerprint grows on a finger. A password's "fingerprint" is calculated with mathematics, and anyone with the same formula can calculate it. So an attacker can try guesses: calculate the fingerprint of each guess and look for a match. That is why a guessable password is weak, even when it is stored this way.

How it actually works

Step 1: the password travels inside HTTPS

When you press "Sign in", your browser sends your username and password to the server. In HTTPS and Encryption Basics you learned that HTTPS encrypts the messages on the way. MDN, a website that documents how the web works, says login forms "should be served over HTTPS".

Step 2: the website keeps a hash, not the password

A hash function is a calculation that turns any text into a code of a fixed length, called a hash. MDN says a hash used for security must be "one-way": from the hash, you should not be able to work out the original text.

This is the difference from encryption. In HTTPS, encrypted messages can be turned back with the key. OWASP, a nonprofit foundation that works "to improve the security of software", says a hash is different: it is "impossible to 'decrypt' a hash".

So, when you create an account, a well-built website hashes your password and saves only the hash. OWASP says passwords should be hashed "rather than encrypted or stored in plaintext" (plaintext means readable text).

Before hashing, the website adds a salt: OWASP describes it as a random piece of text, different for each user. NIST, part of the US government, writes guidelines for logging in to government systems. They say the salt and the hash are both saved for each password. Because of the salt, two people with the same password get different hashes, so attackers must "crack hashes one at a time", OWASP says.

Step 3: the website compares hashes

When you log in, the server takes your saved salt, adds it to what you typed, and hashes the result. If it matches the saved hash, the password was right. So the server sees your password for a moment, but a well-built website does not keep it.

Then, MDN explains, the server answers with a cookie (a small piece of data your browser keeps and sends back). It holds a session ID: a code that tells the server your browser is signed in. You met cookies in Cookies and Privacy.

What happens when you log in (simplified)A browser and a server. First the browser sends the username and password to the server inside HTTPS. The server hashes the password with the user's salt. The server compares the result with the hash it saved. If they match, the server sends back a cookie with a session ID.ServerBrowser2. Hashes itwith the salt3. Compareswith thesaved hash1. Username andpassword (insideHTTPS)4. Match: a cookiewith a session ID

OWASP says that even if an attacker steals the hashed password, "they cannot use it to log in". But attackers can still guess: they hash a guess and compare it with the stolen hash. A short or common password is found quickly. The UK's National Cyber Security Centre (NCSC) warns that weak passwords can be "cracked" (worked out) "in seconds".

Why reusing a password is risky

Attackers sometimes steal data from websites, and stolen passwords can end up online.

OWASP describes credential stuffing ("credentials" are login details): attackers take stolen usernames and passwords and try them on other websites. It works because "many users will re-use the same password". The NCSC says that if one of your accounts is broken into, an attacker "can try the same password on your other accounts".

So use a different password for every account. The NCSC says this matters most for your email: someone who gets into your email could "reset all your other account passwords".

What makes a password strong

  • Long. CISA, a US government security agency, says "at least 16 characters—longer is stronger!" A character is one letter, digit, symbol or space. NIST's 2025 guidelines require at least 15 characters when a password is the only check at login.
  • Random. The NCSC suggests combining three random words. CISA suggests a passphrase: a phrase of "4 – 7 unrelated words".
  • Unique. One password per account.

Password managers

Remembering many long, different passwords is hard. A password manager is a program that "generates, stores and even fills in all your passwords", CISA says. The NCSC says one "might be built into your browser already". You then need to remember only one strong password: the one for the password manager. The NCSC says to protect it with Two-Step Verification too: an extra step that keeps attackers out even if they know your password.

How it came to be

MIT News says Fernando Corbató led the development of the Compatible Time-Sharing System (CTSS) at MIT. It was "first demonstrated in 1961". Users wanted to keep their own files private, so CTSS "introduced the idea of having people create individual accounts with personal passwords". MIT News says it is "widely credited" as the first computer system to use passwords.

🧪 Try it in your browser

These steps work on a computer or a phone. Never type a real password here.

  1. Open MDN's page about password boxes: developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/input/password.
  2. Near the top is an example. Next to its code, it shows a small form with a Password box.
  3. Click in that box (not in the code), and type three made-up words, such as cloud spoon river.
  4. What you should see: each letter appears as a dot (•) or a star (*), depending on your browser and device.

Those dots only hide your password from people looking at your screen. They are not encryption: HTTPS protects the password on its way to the server.

Common misunderstandings

  • "Symbols matter more than length." NIST's guidelines say systems must not force a mix of character types. The NCSC says a longer password is harder to crack. If a website asks for symbols, follow its rules there.
  • "I must change my password every few months." NIST's guidelines say systems must not ask for regular changes. They must ask for a change if there is evidence that the password was stolen.

Recap

  • Your password travels inside HTTPS. A well-built website saves only a salted hash, and checks you by comparing hashes.
  • If one website leaks your password, attackers try it on other websites. Use a different password for every account.
  • Make passwords long, such as several random words, and let a password manager remember them.

Sources

Written with AI · Reviewed by AI · Not yet checked by a human

Found a mistake, or something you did not understand? Report a problem.