Foundation · 2 min
What you need to know
How should ecommerce passwords be protected?
Passwords should be transmitted over protected connections and stored only as salted, slow password hashes using a current approved algorithm. Access to the credential store must be tightly restricted.
What makes a strong password policy?
A strong policy favors sufficient length, blocks common and breached passwords, permits password managers and avoids predictable composition tricks. Add MFA and rate controls for important accounts.
Should customers be forced to change passwords regularly?
Not routinely without evidence of compromise. Forced periodic changes encourage predictable choices; require a change when credentials are exposed, stolen or requested by the user.
How should password resets work?
Reset requests should reveal little about whether an account exists, use a short-lived single-use token, verify the intended account, and notify the user after success. High-risk accounts may need added checks.
How long should password-reset links remain valid?
Keep reset links valid only long enough for normal delivery and completion, based on risk and support conditions. Administrator recovery should generally be tighter than customer recovery.
What happens if a password-reset link is used twice?
A used reset link should become invalid immediately and return a neutral message. Reuse attempts should not change the password and may warrant monitoring.
Should passwords ever be stored in readable form?
No. Staff and systems should never retrieve a customer’s readable password. Support should reset access rather than reveal the original secret.
What is password hashing?
Password hashing converts a password through a one-way, deliberately expensive function, so the original is not stored. A unique salt prevents identical passwords from producing identical stored values.
A quick store check
Review password creation, reset, hashing, reuse protection and compromise response without viewing or exporting any real password.
Foundation · 2 min
Frequently asked questions
Can customer service see whether two passwords match?
No. Password verification should happen inside the authentication system without revealing password values.
Should a reset link identify the account in its URL?
Avoid exposing unnecessary customer identifiers; use a random protected token linked server-side to the request.