header image icon - mountains

Web Application Security: Passwords Checklist

Web Application Security: Passwords Checklist 23

Web Application Security: Passwords Checklist is a guide to enforcing strong password policy and security best practices with your applications.

Web applications require multiple layers of security and passwords still play an important role when securing your web application.

Web Application Security: Passwords Checklist

Web Application Security: Passwords Checklist 24

Minimum Password Length

Set a minimum password length of 12 characters.

Web Application Security: Passwords Checklist 24

Maximum Password Length

Allow users to use passwords with 64 characters or more.

Web Application Security: Passwords Checklist 24

Change Passwords

Allow users to change their passwords.

Web Application Security: Passwords Checklist 24

Allow Two-Factor Authentication Applications

Allow users to setup Two-Factor Authenticator (2FA) applications to prove a second stage of security. Do not use SMS/Txt based 2FA systems.

Example: Google Authenticator (Android or iOS)

Web Application Security: Passwords Checklist 24

Complexity Match Passwords

Require users to set passwords to a complexity match which at least has all of the following criteria: Uppercase, Lowercase, Numbers, and Symbols.

Web Application Security: Passwords Checklist 24

Store Password Using a Strong Hashing Algorithm

When storing password at rest, use strong one-way hashing algorithm/scheme along with a randomly generated salt per password.

Web Application Security: Passwords Checklist 24

Use Full Unicode Characters

Allow users to use the full Unicode character set.

Web Application Security: Passwords Checklist 24

Password Check

Verify that the password registered or updated by my users aren’t using a password found in the top 1,000 (or 10,000) breached passwords.

Web Application Security: Passwords Checklist 24

Password Strength Meter

Display to the user a “password strength meter” showing them the strength or their passwords. This provides the user feedback around the strength of their passwords.

NOTES:

– Don’t force users to periodically rotate/change their passwords
– Allow users to paste, use the browsers password helper, and user password managers while using my application

Passwords checklist has been submitted to us by Geekmasher based on the NIST 800-63 standards.

Related Checklists

Louise Burton-Payne

Checklist Ambassador

Learn to Work Smarter, not Harder!

Leave a Reply

Your email address will not be published. Required fields are marked *