Password Security Best Practices Cheat Sheet

const bcrypt = require('bcrypt');// Hashing: cost factor (salt rounds) controls work factor, 12 is a common defaultasync function hashPassword(plain) {  const saltRounds = 12;  return await bcrypt.hash(plain, saltRounds); // salt is generated and embedded automatically}// Verifyingasync function verifyPassword(plain, hash) {  return await bcrypt.compare(plain, hash); // true/false, timing-safe comparison}// Never store plaintext or use fast hashes like MD5/SHA1 for passwords

password_policy:  min_length: 12          # NIST recommends 8 minimum, 12+ for stronger accounts  max_length: 64          # allow long passphrases, don't artificially cap  require_uppercase: false   # composition rules add little value per NIST  require_special_char: false  check_against_breach_list: true   # reject passwords found in known breach corpora (e.g. HaveIBeenPwned)  block_common_passwords: true      # reject top-10k common password list  allow_paste: true        # supports password managers  lockout_threshold: 10    # account lockout after N failed attempts  mfa_required: true

# SHA-1 hash the password, send only the first 5 hex chars of the hashpassword="CorrectHorseBatteryStaple"hash=$(echo -n "$password" | sha1sum | tr 'a-z' 'A-Z' | cut -c1-40)prefix=${hash:0:5}suffix=${hash:5}curl -s "https://api.pwnedpasswords.com/range/$prefix" | grep -i "$suffix"# If a match with a count > 0 is returned, the password has appeared in a known breach