So, you've answered nature's call, well away from your team, after dark. Or you're a smaller patrol from a larger body, returning to your patrol base, or your main camp, during darkness. Or just a good teamleader, checking on your people in different spots in the middle of the night. They know someone's out there, but the question is, how do you get close enough to prove it's you without getting shot at?
That's the problem challenge and password were designed to solve, going back centuries.
When someone hears you approach, you're told to "Halt!"
(Important safety tip for those who aren't prior-service military: "Halt!" is always shorthand-speak for "I see you, and my front sight is leveled on your center-of-mass." Halt is therefore not a suggestion, any time it is heard. You may safely assume your position is even sketchier than that, depending on the darkness level, the experience level of a given group, or the tactical situation. Respond appropriately. Bullets in flight have no friends forward of the muzzle, and neither do sentries on post until the my team/not my team question has been sorted out to their satisfaction.)
Pay attention at this point, because getting it wrong will see you experiencing fire that is anything but friendly.
Having frozen absolutely in place, the next words will be some version of "Who goes there?"
The correct answer is never, "It's me!", because it's dark, and nobody can tell who "me" is.
You may not get the formal version, you may simply get the challenge. A previously agreed upon word will be spoken, and you'd better come up with the correct reply, quickly, because when this is done right, bullets coming your way are a couple of pounds of trigger squeeze from happening. (This is why you pay attention during daily briefings, and always know the challenge and password.)
The idea is to pick two words that have nothing to do with each other, so that no one can work out even by guessing that the challenge "Indiana" might be answered with "Jones".
A list of them may be generated randomly, and any team or person leaving for multiple days should have each day's challenge and response for the days they're out (ideally memorized, rather than written down).
You're looking for word pairs like "octopus" being answered with "banana", not "banana" and "split".
And to prevent someone nearby in the brush hearing the pair of words correctly, and using them against you, your original challenge at distance may be (ought to be) a number.
The way it works is that at the same time a challenge and password are announced, there is also a number selected. It should be an odd number, from 3-11 or so.
The way that works, is that if the number announced is "nine", you may hear a challenge of "two". You answer the number it takes to make nine, so having passed first grade, you say "seven". At that point, you advance until you're within a couple of steps, and the standard challenge word "octopus" is uttered in your direction very quietly, whereupon you offer "banana", and everyone relaxes a bit as you approach, until they can see you're okay.
If you're the only one, we're done. If not, you tell them, "friendly patrol of eight", and you stay close by to count and ID the other seven members.
This isn't just cool-guy stuff, enemy have infiltrated friendly patrols on dark nights in the jungle or forest, in the real world.
(This is also why you do head counts at halts. I've been out and fallen in along a trail among a group of border crossers at oh-dark-thirty, who had no idea they had picked up several additional members in the dark, until we threw the lights on at their next halt; and war stories abound of NCOs on patrol in places like Vietnam who suddenly had larger patrols than they'd started with, mid-way through.) Things can understandably get messy if you don't notice things like that.
So the number may need to get repeated with each and every approaching member, then the challenge and password when they're up very close.
The reason you picked an odd number is so that the number answered is always a different number than the one challenged. If the number were ten, and the challenge were "five", someone ignorant of your language could mimic "five" in reply, and get it right by blind luck. So odd numbers always.
You may chose to pick and use numbers (or be in the position of someone else doing it) in another language. So you'd better be able to count in whatever the language agreed upon is. It may be advantageous not to let the group in the dark know who you are, whether you're using Spanish in the southwest desert, or using French in the Canadian border woods or bayou swamps, instead of English numbers in either event.
There may also be challenge/password pairs for your home group, and a different one just for your team's use, and different numbers for both. A good idea is to change both daily, at an agreed upon time (probably during the daytime - say, at noon, or 9AM - so no one leaves under one set of passwords/numbers at 6PM, and comes back to a new set after midnight. Imagine if someone's watch were off a bit, and the ensuing mischief that could cause.)
You may also issue codes for duress, which lets a sentry know that you're giving the answers with a gun to your head or a knife to your own throat, or that of someone else in your party. You may also assign an "everything's okay" word as well. Work this out before the day, including if you're going to use it at all.
Working at a gun store, if anyone heard the word "hamburger" spoken aloud by counter staff or the cashiers, a number of guns carried there were going to be coming out momentarily by way of greeting. There's little worse to greet someone trying to stick up the place than eight guys all pointing guns at you. Whatever the decision, and the word, decide on the response to such a code in either case. The person who knows what's going on should be hitting the deck just in time to let the party crashers catch the incoming lead.
That's what challenge/password and number codes are for: to keep your guys alive, and recognize bad guys trying to get in your position when it's too dark to see them. They don't need to know whether or not you can see them in the dark with NODs. They just need to know they're in the crosshairs when you can hear them, and they can hear your challenge.
Responses should be instant, because at night, when people are pointing guns, delay increases stress, and the consequent likelihood of someone getting lit up.