A system and method for storing and accessing password verification data on multi-user computer systems that prevents remote attacks. Along with commonly-employed measures that limit the number of unsuccessful attempts to login or otherwise verify a password, it allows users to choose relatively simple passwords with full security. The secret component cannot be easily leaked or exfiltrated does not require periodic backup and is isolated in a way that allows it to be protected by conventional security measures such as safes, alarm systems and video surveillance from attackers who somehow gain access to the computing facility.