Most people imagine a hacker furiously typing at a keyboard, trying passwords one by one. The reality is far more sophisticated — and faster. Modern password cracking is automated, GPU-accelerated, and targets specific human weaknesses. Here's exactly how it works and what stops it.
How Attackers Get Passwords to Crack
First, understand that attackers rarely crack passwords in real time during an attack. Instead, they:
- Breach a database — steal the hashed passwords from a server
- Take it offline — download the hash file to their own hardware
- Crack at leisure — run cracking tools at billions of attempts per second
This is why even "secure" websites with rate limiting and lockouts can't protect you once their database is compromised. The protection has to be in the password itself.
Attack Method 1: Dictionary Attacks
The most common attack. Attackers have wordlists containing millions of common passwords, leaked passwords, and dictionary words. They hash each one and compare it to the stolen hash. If yours is in the list, it's cracked instantly — even with a "strong" hashing algorithm.
The famous RockYou dataset (leaked in 2009) contains 14 million passwords. Combined with other breaches, attackers now have wordlists of billions of real passwords.
Defence: Only use truly random passwords — they won't appear in any wordlist.
Attack Method 2: Rule-Based Attacks
Dictionary words mutated by rules: capitalize first letter, append "123", replace 'a' with '@', add current year, etc. Hashcat (the most popular cracking tool) includes thousands of such rules. This cracks P@ssw0rd1! as easily as password.
Defence: No dictionary words, regardless of how you mangle them.
Attack Method 3: Brute Force
Trying every possible combination of characters. Against a 6-character lowercase password: 26⁶ = ~308 million combinations. At 100 billion hashes/second (a modern GPU cluster): done in 0.003 seconds.
Defence: Password length. 12+ characters of true randomness is effectively uncrackable via brute force.
Attack Method 4: Credential Stuffing
Take billions of username/password pairs from previous breaches, try them all on new sites. This works because ~65% of users reuse passwords. It's automated — tools like Sentry MBA, STORM, and others can test millions of credential pairs per hour.
Defence: Unique password for every account, no exceptions.
Attack Method 5: Rainbow Tables
Precomputed hash-to-password lookup tables. If the target doesn't use "salting" (random data added before hashing), an attacker can instantly look up any password in a rainbow table. Modern sites use salted hashes, making rainbow tables obsolete for well-implemented systems.
Defence: Websites handle this — but you should still use strong random passwords.
Attack Method 6: Phishing
Technically not "cracking" but far more effective. Fake login pages trick users into typing their real credentials directly to an attacker. No hashing required. Two-factor authentication blocks this even if your password is compromised.
Defence: Enable 2FA on every account, use a password manager (it won't autofill on fake sites), and verify URLs carefully.
What Actually Stops Crackers
Only four things provide real protection:
- True randomness — no human-chosen patterns or words
- Length — 16+ characters for regular accounts
- Uniqueness — never reuse a password
- Two-factor authentication — even if cracked, they can't log in
A 16-character randomly generated password is mathematically impervious to all known cracking methods against properly hashed passwords. Generate yours now — it takes 3 seconds.