Abstract: A method for authenticating a user having a username and password and authenticating access to the user's information. A client computer generates, and sends to a server computer, input data that includes a key (h1) to a dataset of salts accessible to the server computer, a proxy (h2) for the password, a proxy (h4) for the username, and in one embodiment, a different proxy (h8) for the username. The input data does not include the username in plaintext and does not include the password in plaintext. Using the input data and not utilizing the username in plaintext and not utilizing the password in plaintext, the server computer authenticates both the user and access to the user's information, after which the server computer sends, to the client computer, notification that the server computer has authenticated both the user and access to the user's information.