Distributed password verification

1. A method of distributed password verification to prevent unauthorized access to an account, the method comprising:

receiving, from a client, a first set of client identifiers for the client, wherein the first set of client identifiers includes:

a first username for the client,

a first hashed password for the client, and

a first hashed server identifier;

creating an account for the client based on the username for the client;

creating a first token on a first server based on:

an encryption key,

a device identifier for a device used by the client, and

the first set of client identifiers for the client;

transmitting the first token from the first server to the client;

adding, to a honeychecker registry on a second server, the username for the client, wherein the honeychecker registry is a list of valid usernames;

deleting the first token from the first server;

deleting the first set of client identifiers from the first server;

receiving, on the first server, a second token, wherein:

the second token is encrypted, and

the second token is equivalent to the first token;

receiving, on the first server, a second set of client identifiers for the client, wherein the second set of client identifiers includes:

a second username,

a second hashed password, and

a second hashed server identifier;

decrypting the second token using a decryption key to reveal the first set of client identifiers;

verifying the second token with a comparison of:

the second hashed server identifier, and

the first hashed server identifier in the second token; validating an identity of the client with a comparison of:

the second hashed password, and

the first hashed password for the client in the second token;

logging the second username to an authentication log;

determining that the second username does not appear in the honeychecker registry;

responsive to determining that the second username does not appear in the honeychecker registry, denying, to the client, access to the account to prevent an unauthorized access;

responsive to determining that the second username does not appear in the honeychecker registry, locking the account to prevent a future unauthorized access;

responsive to determining that the second username does not appear in the honeychecker registry, determining the first server is compromised; and

responsive to determining the first server is compromised, transmitting an alert to the client that the first server is compromised;

wherein:

at least deleting the first token from the first server is performed by computer software running on computer hardware.