In Mac OS X releases prior to 10.3, account passwords were always stored as hashes generated by the old Unix crypt function. One of its shortcomings is that passwords cannot be more than eight characters long: anything beyond eight characters is ignored. These password hashes are also stored directly in the NetInfo database, viewable by anyone with access to the system. This means a malicious user can grab everyone's encrypted passwords and run a password cracking program on them to try to gain further access.
One of the many improvements in Panther is support for longer passwords using a different hash algorithm (I'm not sure if it's md5 or something else). It also adds shadow password functionality, which means the encrypted password hash is not stored directly in NetInfo. Accounts with new passwords must authenticate using a special API in the DirectoryService Framework, which never reveals the encrypted password hash.
All new accounts created in Panther use the new password scheme by default, so there's nothing you need to do to enable it for them. But if you did an upgrade or archive install from a previous version of Mac OS X, your old accoutn passwords were carried over and used unchanged in Panther. To change your account to use the new password encryption is simple:
That's it. You don't even have to change your password -- you can use the same one. But hey, maybe now is a good excuse to change it anyway? To verify that the change worked, follow these steps:
Finally, note that some unix programs that need to authenticate users may not be updated to handle the new passwords yet. This hint shows one example.
Mac OS X Hints
http://hints.macworld.com/article.php?story=20031107215426990