Developers must never store passwords in plain text. Secure systems use hashing and salting (like bcrypt) to transform passwords into unreadable strings [23].

A client (like your phone) requests access, the server prompts for credentials, and upon successful validation, the server returns the requested resource or a "session" token [31].

Modern design focuses on reducing "friction"—anything that makes it harder for a user to get inside.