Passwords

A password is a widely used access restriction: it asks you to provide a secret before a system will let you in. You type the secret and the system checks it against the password record it holds for your account. If the two match, access is allowed; if they do not, access is refused.

stored_password = "Maple42"
entered_password = input("Enter password: ")

# compare the typed secret with the stored one
if entered_password == stored_password:
    print("Access granted")
else:
    print("Access denied")

Output when the user types Maple42:

Enter password: Maple42
Access granted

Passwords are simple and low cost. They need no special equipment beyond a keyboard, so they work on almost any device, and a system can hold passwords for thousands of users without buying extra hardware. They can also be changed whenever you need to: if you think someone else has learned your secret, you replace it with a new one and the old secret stops working.

The password must stay secret

A password is only effective while it stays secret. The system cannot tell the difference between you and anyone else who knows your secret, so if someone watches you type it, or reads it from a note beside the screen, it has stopped being a secret and no longer protects the account.

Hard to guess, hard to remember

A strong password is harder for someone to guess, but it can also be difficult to remember. A long, random mix of characters is not easy to recall, so a user might write it down or swap it for something memorable but easy to guess, which weakens the protection.

People may also reuse passwords across systems. For example, if the same secret unlocks a photo-sharing app and your school email account, a leak from the app could give an attacker a working password for the email account. One compromised password can therefore put several systems at risk.