A password input and verification method is provided to prevent the disclosing of the password from peeping. The method is easy to learn, transparent to the users, and requires no hardware change and only minor software modification. The method allows a user to enter a much longer string of characters when he or she is asked for the password. The user is then authenticated if the actual password is embedded as a whole anywhere within the input string. The method also provides a mechanism called prohibition key. A prohibition key is a pre-determined character that, when present in the user input string, the user is not authenticated regardless of whether the actual password is contained in the input string or not.