Cyber threats · Learn

What is password cracking?

Password cracking is what happens to a stolen password database next: an attacker guessing the real passwords offline, at enormous speed. Here is how it works, and why how you store passwords decides who wins.

Cyber threats · LearnSecurity services Download PDF
TL;DR

Password cracking is recovering a password from its stored (hashed) form, usually offline after an attacker steals a password database. Techniques range from brute force and dictionary attacks to GPU-accelerated, rule-based guessing. Weak, reused, or poorly hashed passwords fall in seconds. The defenses are long unique passwords, modern slow hashing with unique salts, and multi-factor authentication so a cracked password is not enough.

By Pranav Khune, Lead Pentester, SecureLayer7Updated

How password cracking works

Systems should never store passwords as plain text. They store a hash, a one-way scramble. When you log in, the system hashes what you typed and compares. Cracking is the attempt to reverse that: given a stolen hash, find the input that produces it.

The key split is offline versus online. Online cracking guesses against a live login and is slowed by rate limits and lockouts. Offline cracking happens after an attacker has stolen the hash database, on their own hardware, with no rate limit at all, which is why a breach of hashed passwords is still serious.

The main techniques

Attackers rarely guess blindly:

  • Brute force tries every combination, feasible only for short passwords.
  • Dictionary attacks try known words and common passwords first.
  • Rule and mask attacks mutate dictionary words the way people do (Password becomes P@ssw0rd!), which is devastatingly effective.
  • Hybrid attacks combine dictionaries with brute force on the ends.
  • Rainbow tables use precomputed hashes, which is exactly why unique salts exist to defeat them.

Modern GPUs test billions of guesses per second against fast hashes, so "complex-looking" is not the same as "strong".

Why how you store passwords decides who wins

The single biggest factor in whether stolen passwords get cracked is how they were hashed:

  • Fast, unsalted hashes (MD5, SHA-1, plain SHA-256) fall almost instantly on modern hardware.
  • Slow, salted, purpose-built hashes (bcrypt, scrypt, Argon2) are designed to be expensive to compute, turning billions of guesses per second into thousands.
  • A unique salt per password stops one cracked hash from revealing every user who chose the same password, and kills rainbow tables.

If you build software, this is the control that matters most. Use a modern slow algorithm with unique salts, and a stolen database buys the attacker far less.

How to defend against password cracking

Defense runs on both sides of the login:

  • Long, unique passwords in a password manager, so length beats guessing and one leak does not open other accounts.
  • Modern slow hashing with unique salts for any passwords you store.
  • Multi-factor authentication, so even a cracked password is not enough to log in.
  • Block known-breached passwords at sign-up and reset.
  • Rate-limit and lock out online guessing, and monitor for attempts to dump password stores.

A penetration test that includes credential attacks shows whether your stored hashes, or your login endpoints, would actually hold.

References

  1. [1]Brute Force (Technique T1110)(MITRE ATT&CK)
  2. [2]Digital Identity Guidelines (SP 800-63B)(NIST)
  3. [3]Password Storage Cheat Sheet(OWASP)
Related terms

Password cracking rewards two mistakes: weak passwords and weak hashing. Fix both, add multi-factor authentication, and a stolen password store stops being a catastrophe.

Common questions

Password cracking, asked often

Scope an engagement

Find out whether your passwords, and your hashes, would hold.

We test login endpoints and, where in scope, stored credentials the way an attacker would, and hand your team the weak spots and the fix.