Credentials and other sensitive strings can undergo automatic rotation before each transmission or storage of those credentials. String modification, which can utilize a key stretching algorithm, can be used to modify the credential before transmission. This can be for an initial sign up, a subsequent login, or another such action. A random number can be generated to determine the number of iterations for the key stretching algorithm to be applied. For subsequent actions, a new random number can be added to the prior iteration number in order to create a new string that can be generated using the previously utilized iteration number and the new random number, with only the new random number being transmitted with the modified credential string. This increases security, as the transmission itself cannot be used to recover the original plaintext credential if recovered.