Password authentication for web and mobile apps