Web applications today still struggle with basic password security. Billions of passwords have been leaked by companies. Even the big boys aren't immune. In this presentation we'll discuss the basics of good password protection as well as advanced topics. Topics include encryption, hashes, salts, peppers, key stretching, length constant comparisons, algorithms, and user policy. Multi-language code and DB examples will provide developers insight to actual implementation of topics. We'll also cover new password security recommendations announced by the National Institute of Standards and Technology (NIST).