How password cracking works

Guide · 6 minute read

Online vs offline attacks

There are two very different ways to attack a password.

In an online attack, someone types guesses into a real login page. Websites slow this down with rate limits, lockouts and CAPTCHAs, so an attacker gets maybe a hundred guesses an hour. Only the most common passwords fall this way.

In an offline attack, the attacker has stolen the website's password database. Sites don't store your password itself but a scrambled version of it, a hash. Hashes can't be reversed, but the attacker can hash billions of guesses per second on their own graphics cards and compare the results. No rate limits, no lockouts, nobody notices. This is the attack your password has to survive.

Step 1: the obvious passwords

Crackers start with lists of real passwords from earlier breaches. Billions of them are publicly available. If your password has ever been leaked, by you or by anyone else who happened to choose it, it's on those lists and falls instantly. That includes many that look strong, such as Tr0ub4dor&3.

Step 2: dictionaries and rules

Next come dictionaries of words, names, places, sports teams and pop culture, combined with rules that copy how people tweak them:

• capitalise the first letter: summer → Summer
• add a year or number: Summer2024
• add a symbol at the end: Summer2024!
• swap look-alike characters: $umm3r
• join two words or repeat one: summersummer

Because millions of people follow the same habits, a few thousand rules crack a huge share of human-made passwords within hours. "Complex" passwords built this way feel strong but aren't.

Step 3: brute force

Finally, the attacker can try every possible combination. This is where length and randomness come in, because the number of combinations grows exponentially:

The table assumes truly random characters from a set of about 65. A password that's only "random-looking" because you invented it is cracked in step 1 or 2, long before brute force matters.

Credential stuffing: why reuse is the real danger

Once attackers have email and password pairs from one breach, they try them automatically on hundreds of other sites: email providers, banks, shops, social media. This is called credential stuffing, and it's how most accounts are taken over. It doesn't matter how strong a password is if it's been leaked from another site where you used it.

What actually protects you

1. Randomness. A password chosen by a password generator isn't in any list and doesn't follow any rule, so attackers are stuck with brute force.
2. Length. 16 random characters, or 5–6 random words with a passphrase generator, puts brute force out of reach.
3. Uniqueness. A different password on every site turns a breach into one changed password instead of a disaster. A password manager makes this painless.
4. Two-factor authentication. Even a cracked or leaked password isn't enough to log in.

Curious how your password would fare? The password strength checker runs the same kind of pattern analysis on your device and can tell you whether it already appears in a known breach.