Developer authentication guidance
Design password storage, reset flows, sessions, abuse controls and passkey adoption as one tested authentication system.
How to use this section
Use the Developer authentication guidance directory to choose the page that matches the decision or problem you have now. Follow official provider links for account actions, and never enter a password or recovery code into an informational guide.
What belongs in this section
Authentication is a system of registration, storage, login, recovery, sessions and abuse controls. Review the failure path as carefully as the successful sign-in path and test rate limits and enumeration behavior.
Argon2id Implementation Planning
Choose supported libraries, parameters, resource limits and upgrade strategy.
Open guide →Bcrypt Migration Plan
Upgrade legacy password hashes safely during login or forced reset.
Open guide →Credential-Stuffing Defense
Use breached-password blocking, MFA, anomaly signals and session protection against reused credentials.
Open guide →Forgot-Password Flow Design
Build uniform responses, expiring tokens and post-reset protection without account enumeration.
Open guide →Login Rate Limiting
Reduce brute force, password spraying and credential stuffing without easy denial of service.
Open guide →Passkey Rollout Plan
Introduce WebAuthn credentials with clear enrollment, device and recovery choices.
Open guide →Password Hashing Architecture
Separate password verification, storage parameters, migration and breach response.
Open guide →Prevent Account Enumeration
Reduce username discovery across login, signup and recovery flows.
Open guide →Secure Session Token Design
Generate, store, rotate and invalidate session identifiers safely.
Open guide →Standards and source notes
This page is maintained by the Password Tools Hub Editorial Team. General password guidance is checked against NIST SP 800-63B and the OWASP Authentication Cheat Sheet. Product interfaces can change; use the linked provider documentation for the final account action.