Summary: Password authentication is one of the most common and elementary applications of encryption techniques, and when these authentication services are embedded into the underlying operation system, their security is usually assured. However, there are an increasing number of systems requiring authentication services which are layered on top of a host operating system. In these cases the security of the application system is highly dependent on the security of the password file, and, when operating outside the host operating system, compromises of the password file need to be taken seriously. We propose three different password protection schemes which preserve system security even if the password file is compromised. These schemes are based on the concepts of public-key cryptography: public-key encryption, public-key distribution and quadratic residues. In each scheme the user’s password is effectively bound to the user’s identification, regardless of the state of the password file, in a time-efficient and simple manner. We discuss the special features, degrees of secrecy, advantages and disadvantages for each scheme.