Sometimes users or clients request a feature in the admin panel (or personal account) that would require the system to enter a password for every important action and "remember" it.
At first glance, this seems to double the security. But in reality, it creates a false sense of security and doesn't protect against the main threat.
How does this usually work technically?
To "remember" a password for the duration of a session, the site must store it in your browser. This is most often done through:
Cookies: The site stores your password directly in a cookie file. Even if it's encrypted, an attacker who steals your session can intercept it.
Local Storage: The site stores the password in the tab's memory. This is slightly more convenient for the developer, but for a virus or hacker, it's as open a book as a cookie.
Why is this pointless?
Imagine your session is your apartment key, and your password is the passport you showed when entering the building.
If your session (key) is stolen: The attacker has already entered your "apartment" (account). If we ask them to confirm their action with a password, it's as if we're asking, "Show me your passport." But the passport (password) is in the same place as the key (in cookies or browser memory). Did the thief take your keychain? They also grabbed a copy of your passport, which was lying nearby.
Plaintext password: Even if you use complex client-side encryption (in JavaScript), a hacker who already has access to your session also has access to the decryptor. They'll simply run the same function the website uses to extract the password.
The Right Approach to Security
If the action is truly important (withdrawing money, changing email), password re-entry (re-authentication) is used instead of remembering the password.
How it's done normally (Google, banks, exchanges):
The user clicks "Transfer money."
The system interrupts the session and requires the user to re-enter the password manually (or send a code via SMS).
The password is verified on the server and immediately destroyed. It is not stored in cookies or memory.
If the session is hijacked, the thief will hit a wall: they don't know the password by heart, and there's nowhere to look it up—the system doesn't store it.
The request to "remember the password" is an attempt to combine convenience (not having to enter it constantly) with security (having to confirm actions). This doesn't work. If you saved your password in the browser, you created a second copy of the key and put it under the doormat.
