Why not passwords, and what hashing is
tl;dr
Passwords fail because humans are predictable, not because the maths is weak. Hashing turns any input into a fixed string — and because it's deterministic, someone has already precomputed the common answers.
Username and password is low friction and universally understood. It's also a list of problems: credentials get stolen, guessed, sniffed over the wire, changed on you, or simply forgotten.
But the real weakness isn't cryptographic. It's that humans are predictable.
password is still the most-used password on the internet. We hear about
breaches constantly and change nothing, because we're remarkably resistant to
changing our own behaviour even when it works against us.
You think you're being clever with p@ssword. The people whose job is guessing
your password thought of that a long time ago.
Real randomness is computer-generated and looks like line noise — which is exactly why you won't remember it, and why the honest answer is a password manager. Jem's recommendation is 1Password or KeePass, and explicitly not LastPass, whose security he calls questionable. He doesn't know any of his own passwords, which is the point.
Why servers get the strict treatment
If someone takes your laptop account, that's bad. If someone takes your server, they can mine crypto on it, launch DDoS attacks from it, or serve illegal content from it — and it's registered to you. That's why servers don't get username and password at all.
Biometrics would be lovely, but they aren't portable, most devices don't support them, and there's no real standard yet. Give it ten years.
So: SSH keys. And to understand those, you need hashing.
What a hash is
Take some data — it's just bits and bytes. Run it through a mathematical function. Out comes a fixed-length string of numbers and letters.
That's it. Input, maths, output. It isn't only encryption — verifying a file arrived intact is a hash too. It's a way of representing a large amount of information in a small number of characters.
You can try it right now, because it ships with the OS:
echo password >> foo
openssl md5 foo
Why MD5 died
Run the same word through MD5 and everyone gets the same hash. Every time, on every machine, forever.
So someone hashed every common password and stored the pairs. That lookup is called a rainbow table, and for MD5 it already exists for essentially every word in the language. Your hash isn't a secret; it's an index into a table someone published years ago.
Which raises the obvious question: how do you make the same password produce a different hash for every person who uses it?
That's the next lesson.