Why do most websites use the pair of username and password as we can just use a long password like a token to identify a user?

A simple example: On the server, we create a JSON file with user data inside of it (email, role etc.) and give it a random 32-characters name. Then if a user wants to log in, he just copy/paste his long password into one form input and submits the form. If submitted password matches with the name of JSON file on the server, the authorization is successful and the server identifies the user.

So why not and why username and password?


You've just described API keys and that concept is used everywhere.

You want a username and password pair for two practical reasons:

  1. if users can create their own passwords, you risk people having the same password
  2. if a user needs to change their password, doing so won't invalidate the identity of the user on the system if the password is also the user's identity
  • I know about both aspects you've mentioned, but 32-characters string is always unique, otherwise anyone can hack such password even if he is not a hacker. And if a user decided to change his password, he just rename the JSON file. – stckvrw Jun 11 '20 at 7:42
  • "32-characters string is always unique" -- that's not true. It's close to being true if it is a randomly generated 32 char string. – schroeder Jun 11 '20 at 7:43
  • 1
    "he just rename the JSON file" -- then the file name becomes the username... – schroeder Jun 11 '20 at 7:43
  • In my question I mentioned "random 32-characters name", as API key. As for your comment about renaming the file, sorry I can't understand what you mean. A user just generate new random string and set it as new file name. – stckvrw Jun 11 '20 at 7:46
  • 1
    No, there is nothing in that process that is anything like a normal password process. – schroeder Jun 11 '20 at 9:23

Not the answer you're looking for? Browse other questions tagged or ask your own question.