Glossary
Credential management is the practice of securely handling credentials, passwords, keys, certificates, tokens, and passkeys, across their whole lifecycle: creation, storage, rotation, and revocation. Weak credential management is behind a large share of breaches, so doing it well is foundational security.
A credential is only as safe as how it is created, where it lives, how often it changes, and how quickly it can be killed. Failures at any of those stages are what attackers exploit.
For human users it includes how credentials are issued and stored (ideally moving away from passwords toward passkeys), and how account recovery works when a credential is lost. For machine and non-human identities it includes issuing keys and certificates, rotating them regularly, storing secrets securely rather than hard-coding them, and revoking them promptly when no longer needed. Poorly managed machine credentials, long-lived, over-permissioned, or leaked in code, are a common breach vector.
The strongest form of credential management is having fewer credentials to manage. Going passwordless removes the most-attacked credential entirely, so there is no password to store, rotate, or leak. For the credentials that remain (machine keys, certificates, tokens), short lifetimes, automated rotation, and strong secrets management shrink the window an attacker has. Reducing and hardening credentials beats trying to perfectly guard a sprawl of long-lived ones.
What is credential management?
Securely creating, storing, rotating, and revoking credentials (passwords, keys, certificates, tokens, passkeys) across their lifecycle.
Why does credential management matter?
Weak handling of credentials, especially long-lived or leaked ones, is behind a large share of breaches.
How does going passwordless help?
It removes the most-attacked credential entirely, so there’s no password to store, rotate, or leak.
Related: Passwordless Authentication · Passkeys · Machine Identity · Non-Human Identity (NHI) · Account Recovery
