@cryptotaxi247 / documentation
Code Commits Issues Pulls Sessions CI/CD
patch-1
@reggi/path-to-regexp dependabot/npm_and_yarn/main/copy-to-clipboard-4.0.2 dependabot/npm_and_yarn/main/eslint-10.4.0 dependabot/npm_and_yarn/main/npmcli/eslint-config-7.0.0 dependabot/npm_and_yarn/main/proc-log-7.0.0 dependabot/npm_and_yarn/npm_and_yarn-826852524d dependabot/npm_and_yarn/npm_and_yarn-ab9a7f4bc2 deprecate-totp-2fa dhei/classic-tokens gat-bypass-2fa-docs jpg619/fix-accessibility-content-flow jpg619/version-bump-tar-2 kartykp/gat-bypass-2fa-docs kartykp/upgrade-path-to-regex main maitxn/version-bump-tar patch-1 reggi/cache-based-on-version reggi/dev-engines reggi/fix-transform-prettier reggi/overrides update-search-sensitivity
mdx 22 lines 1.58 KB
Raw
1 ---
2 title: Creating a strong password
3 ---
4
5 Secure your npm account with a strong and unique password using a password manager.
6
7 You must choose or generate a password for your npm account that:
8
9 - is longer than 10 characters
10 - does not match or significantly contain your username, e.g. do not use 'username123'
11 - has not been compromised and known to the [Have I Been Pwned](https://haveibeenpwned.com/) breach database
12
13 To keep your account secure, we recommend you follow these best practices:
14
15 - Use a password manager, such as [1Password](https://1password.com/), to generate a password more than 16 characters.
16 - Generate a unique password for npm. If you use your npm password elsewhere and that service is compromised, then attackers or other malicious actors could use that information to access your npm account.
17 - Configure two-factor authentication for your account. For more information, see "About two-factor authentication."
18 - Never share your password, even with a potential collaborator. Each person should use their own personal account on npm. For more information on ways to collaborate, see: "[npm organizations](/organizations)".
19
20 When you type a password to sign in, create an account, or change your password, npm will check if the password you entered is considered weak according to datasets like HaveIBeenPwned. The password may be identified as weak even if you have never used that password before.
21
22 npm only inspects the password at the time you type it, and never stores the password you entered in plaintext. For more information, see [HaveIBeenPwned](https://haveibeenpwned.com/).