How passwords and logins work: why a website should not know your password

A well-built website cannot tell anyone your password, not even its own staff. Yet it knows at once when you type it wrong. Facebook got this wrong. In 2019, it found hundreds of millions of passwords that its staff could read in its own systems. Meet the real pieces of a login: password hashing and salt, why a stolen list of passwords still hurts, strong and reused passwords, two-factor authentication and phishing, passkeys, and the session cookie that keeps you logged in.