What is a password hint?
Password hints and security questions let you recover access by proving you know something personal. Their answers are often guessable or public on social media. Unlike a password, a biographical fact cannot be changed after exposure. Current NIST guidance does not permit knowledge-based questions for digital authentication.
- Topic
- Authentication
- Also called
- security question, knowledge-based authentication
- Reading time
- 1 min
- Reviewed
On this page
Why they undermine strong passwords
A recovery mechanism is an alternative way in, so an account is only as strong as its weakest route. A 20-character random password guarded by 'What was your first pet's name?' is protected by the pet's name. Breaches have also leaked hint fields in plaintext, handing attackers the answer directly.
How to handle a mandatory one
Where you cannot skip it, do not answer truthfully. Generate a random string and store it as if it were a second password. The field only has to match; the answer does not have to be true.
What people often get wrong
"Security questions add a layer of protection."
They usually subtract one. They create a second, weaker way into the account, and their answers are often discoverable or unchangeable.
Sources
These primary references support the terminology and current security guidance used in this definition.
