# What is a password hint?

> A reminder or personal question used to recover access. Its answer is often easier to guess than the password.

Last reviewed: 2026-09-01

## Password hint

Category: Authentication

Also called: security question, knowledge-based authentication

Canonical page: https://moolkey.com/glossary/password-hint

Password hints and security questions let you recover access by proving you know something personal. Their answers are often guessable or public on social media. Unlike a password, a biographical fact cannot be changed after exposure. Current NIST guidance does not permit knowledge-based questions for digital authentication.

### Why they undermine strong passwords

A recovery mechanism is an alternative way in, so an account is only as strong as its weakest route. A 20-character random password guarded by 'What was your first pet's name?' is protected by the pet's name. Breaches have also leaked hint fields in plaintext, handing attackers the answer directly.

### How to handle a mandatory one

Where you cannot skip it, do not answer truthfully. Generate a random string and store it as if it were a second password. The field only has to match; the answer does not have to be true.

### What people often get wrong

Claim: "Security questions add a layer of protection."

Correction: They usually subtract one. They create a second, weaker way into the account, and their answers are often discoverable or unchangeable.

### Sources

- [NIST: SP 800-63B-4: Authentication and authenticator management](https://csrc.nist.gov/pubs/sp/800/63/b/4/final): Current requirements for passwords, authenticators, recovery, and rate limits.
- [OWASP: Multifactor Authentication Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Multifactor_Authentication_Cheat_Sheet.html): A comparison of authentication factors, recovery paths, and common attack routes.