Password cracking is recovering a password from its stored (hashed) form, usually offline after an attacker steals a password database. Techniques range from brute force and dictionary attacks to GPU-accelerated, rule-based guessing. Weak, reused, or poorly hashed passwords fall in seconds. The defenses are long unique passwords, modern slow hashing with unique salts, and multi-factor authentication so a cracked password is not enough.
How password cracking works
Systems should never store passwords as plain text. They store a hash, a one-way scramble. When you log in, the system hashes what you typed and compares. Cracking is the attempt to reverse that: given a stolen hash, find the input that produces it.
The key split is offline versus online. Online cracking guesses against a live login and is slowed by rate limits and lockouts. Offline cracking happens after an attacker has stolen the hash database, on their own hardware, with no rate limit at all, which is why a breach of hashed passwords is still serious.
The main techniques
Attackers rarely guess blindly:
- Brute force tries every combination, feasible only for short passwords.
- Dictionary attacks try known words and common passwords first.
- Rule and mask attacks mutate dictionary words the way people do (Password becomes P@ssw0rd!), which is devastatingly effective.
- Hybrid attacks combine dictionaries with brute force on the ends.
- Rainbow tables use precomputed hashes, which is exactly why unique salts exist to defeat them.
Modern GPUs test billions of guesses per second against fast hashes, so "complex-looking" is not the same as "strong".
Why how you store passwords decides who wins
The single biggest factor in whether stolen passwords get cracked is how they were hashed:
- Fast, unsalted hashes (MD5, SHA-1, plain SHA-256) fall almost instantly on modern hardware.
- Slow, salted, purpose-built hashes (bcrypt, scrypt, Argon2) are designed to be expensive to compute, turning billions of guesses per second into thousands.
- A unique salt per password stops one cracked hash from revealing every user who chose the same password, and kills rainbow tables.
If you build software, this is the control that matters most. Use a modern slow algorithm with unique salts, and a stolen database buys the attacker far less.
How to defend against password cracking
Defense runs on both sides of the login:
- Long, unique passwords in a password manager, so length beats guessing and one leak does not open other accounts.
- Modern slow hashing with unique salts for any passwords you store.
- Multi-factor authentication, so even a cracked password is not enough to log in.
- Block known-breached passwords at sign-up and reset.
- Rate-limit and lock out online guessing, and monitor for attempts to dump password stores.
A penetration test that includes credential attacks shows whether your stored hashes, or your login endpoints, would actually hold.
References
- [1]Brute Force (Technique T1110)(MITRE ATT&CK)
- [2]Digital Identity Guidelines (SP 800-63B)(NIST)
- [3]Password Storage Cheat Sheet(OWASP)
Password cracking rewards two mistakes: weak passwords and weak hashing. Fix both, add multi-factor authentication, and a stolen password store stops being a catastrophe.