Introduction
A major social media platform suffers a data breach.
500 million user account databases are leaked on the dark web.
Within 48 hours, attackers have cracked 73% of the passwords.
But here's the problem:
👉 Most users believed their passwords were "safe" because the website stored hashed versions. They had no idea that modern password cracking techniques can crack simple hashed passwords at billions of guesses per second.
Understanding how passwords are attacked is one of the most fundamentally important concepts in both offensive and defensive security. For the penetration tester, cracking captured password hashes is a critical post-exploitation step that unlocks lateral movement across an entire corporate network. For the defender, understanding exactly how these techniques work is the only way to implement truly effective password policies and storage standards.
Instead of treating password security as a simple matter of "make it long and complex," understanding the underlying mechanics of how attackers defeat passwords gives you the knowledge to build defenses that actually hold.
In this comprehensive guide, you'll learn:
- Why passwords are stored as hashes and what that actually means cryptographically
- The major categories of password cracking techniques and how each one works
- Why "offline" cracking is so dramatically more powerful than online guessing
- How modern cracking hardware completes billions of attempts per second
- Which password choices are genuinely resistant to modern cracking
- The defensive countermeasures that dramatically slow or defeat cracking attacks
By the end of this article, you will understand the complete lifecycle of a password attack, from capturing a hash to cracking it—and, crucially, you will know how to defend against every technique described.
Why Passwords are Stored as Hashes
Before discussing password cracking techniques, you must understand why passwords are hashed in the first place, and the critical implications of that design choice.
A well-designed web application never stores your actual plaintext password in its database. Instead, when you create an account, the system runs your password through a cryptographic hashing algorithm (like bcrypt, SHA-256, or MD5). This algorithm converts your password into a fixed-length string of seemingly random characters (the "hash"). The website stores only this hash.
When you log in next time, the system hashes the password you entered and compares the result against the stored hash. If they match, login succeeds.
Why Hashing is Theoretically One-Way
The beauty of cryptographic hashing is that it is designed to be a one-way function—you cannot mathematically reverse the hash back into the original plaintext. You can only go from password → hash, never from hash → password directly.
The Vulnerability: What Makes Cracking Possible
So if hashing is one-way, how do crackers reverse it? They don't. They simply reproduce it. They take a candidate password (say, "password123"), hash it themselves, and compare that hash against the target's stored hash. If the hashes match, they know the plaintext. This process—generating hashes for billions of candidate passwords—is what all password cracking techniques are fundamentally built upon.
Offline vs. Online Password Cracking
This is a critical distinction that defines most of what makes cracking so powerful.
Online Attacks (Login Pages)
An online attack attempts to log in directly to the live service (guessing passwords against a real login form). Online attacks are heavily restricted:
- Most services implement rate limiting (slowing requests after too many failures).
- Account lockout after 5 or 10 failures is standard.
- CAPTCHAs prevent automated attempt flooding.
This makes online cracking slow, noisy, and largely ineffective against properly configured services.
Offline Attacks (Captured Hash Cracking)
After a database breach gives an attacker the raw hashed password file, they can perform offline cracking. They run their cracking tool locally on their own hardware with zero restrictions. There is no rate limiting, no account lockout, no detection, and no network bottleneck.
A modern consumer graphics card (GPU) can perform:
- MD5 hashes: Over 50 billion guesses per second.
- SHA-1 hashes: Over 20 billion guesses per second.
- bcrypt hashes: Approximately 50,000 guesses per second (this is why bcrypt is designed specifically for password storage).
The staggering speed differential between different hash algorithms is the most important variable in password security.
The Major Password Cracking Techniques
1. Dictionary Attack
The dictionary attack is by far the most common and effective technique against real-world passwords. It involves taking a wordlist file containing millions of words, common phrases, and previously leaked passwords, hashing each one, and comparing the result against the target hash.
The industry-standard wordlist is rockyou.txt—a list of over 14 million real passwords recovered from a major historical data breach, available by default on Kali Linux.
Why it works: Human beings are terrible at creating truly random passwords. We choose words from our language, names, dates, and patterns we find memorable. The rockyou.txt wordlist contains the actual passwords that millions of real people chose—meaning it is a highly optimized starting point.
Hashcat command:
hashcat -m 0 -a 0 hashes.txt rockyou.txt # -m 0 = MD5, -a 0 = dictionary attack
2. Brute Force Attack
A pure brute force attack systematically tries every possible combination of characters (letters, numbers, symbols) up to a specified length until a match is found.
Why it is rarely used today in its pure form: The mathematical scale is enormous. A password that is only 8 characters long using lowercase letters, uppercase letters, numbers, and common symbols has approximately 6.7 quadrillion possible combinations. Even at 50 billion MD5 guesses per second, cracking a truly random 8-character password takes an average of 37 hours. A random 12-character password: effectively infeasible within any reasonable time frame.
Brute force is effective against very short passwords (under 7 characters) or against extremely slow hash algorithms.
hashcat -m 0 -a 3 hashes.txt ?a?a?a?a?a?a?a?a # 8-character mask brute force
3. Hybrid Attack
The hybrid attack is significantly more sophisticated and effective than pure brute force. It takes words from a dictionary and systematically appends or prepends characters, numbers, and symbols to each word.
For example, applying a hybrid attack to the word "summer" would generate: summer1, summer2, summer!, summer2024, Summer!, 1summer, !summer, and so on.
This is deeply effective because most users do not create truly random passwords. Instead, they choose a memorable word and meet the password policy's "complexity requirements" by adding numbers or characters at the beginning or end.
hashcat -m 0 -a 6 hashes.txt rockyou.txt ?d?d?d # Append 3 digits to each wordlist entry
4. Rule-Based Attack
The rule-based attack applies a set of transformation rules to each word in a dictionary. These rules model how humans actually modify passwords to meet complexity requirements:
c— Capitalize the first letter.$1— Append the number "1" to the end.r— Reverse the entire word.u— Convert all characters to uppercase.sa@— Substitute all occurrences of 'a' with '@'.
Hashcat includes built-in rule files (like best64.rule) that apply the 64 most statistically common transformations. Running rockyou.txt through best64.rule generates over 900 million candidate passwords and cracks the overwhelming majority of passwords chosen by real users within minutes.
hashcat -m 0 -a 0 hashes.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule
5. Rainbow Table Attack
A rainbow table is a pre-computed lookup table of hash-to-password mappings. An attacker pre-computes the hashes of billions of potential passwords and stores the results in a massive indexed table. To crack a hash, they simply look it up in the table—nearly instantaneous.
Why Salt defeats Rainbow Tables:
Modern password storage systems add a unique random string (called a "salt") to each password before hashing it: Hash(password + unique_salt). Each user gets a unique salt stored alongside their hash in the database.
Because every user has a different salt, an attacker cannot use pre-computed rainbow tables. They would need to generate an entirely new rainbow table for each user's unique salt—computationally infeasible. This is why all modern password storage libraries use salting by default.
6. Credential Stuffing
Credential stuffing is technically distinct from hash cracking. Using leaked plaintext credential lists from previous breaches (username + password pairs where the hash has already been cracked), attackers systematically test those exact username/password combinations against other online services, exploiting the common human habit of reusing the same password across multiple websites.
This is why a breach at a small forum website can directly lead to attackers accessing someone's banking account—if the same email and password combination was reused.
Defensive Countermeasures
Understanding password cracking techniques is only valuable if it leads to effective defensive changes.
1. Use Strong Hashing Algorithms
Never store passwords with MD5 or SHA-1. These algorithms are designed for speed (for file integrity checking), which makes them catastrophically fast to crack. Always use purpose-built password hashing algorithms that are deliberately slow:
- bcrypt: Includes a built-in work factor (cost parameter). As hardware gets faster, you increase the cost.
- Argon2: The 2015 Password Hashing Competition winner. Highly resistant to both GPU and ASIC-based cracking.
- scrypt: Memory-hard, making it expensive to run on GPUs with limited memory.
2. Always Use Salting
Every modern password hashing library automatically generates a unique, random salt for each password. Use established libraries (bcrypt, Argon2) rather than rolling your own implementation.
3. Enforce Multi-Factor Authentication (MFA)
Even if an attacker cracks a user's password from a breached database, MFA prevents them from actually logging in with the stolen credential. Implementing MFA across all critical accounts is the highest-return defensive investment available.
4. Use a Password Manager
The only realistic way humans can use long, random, unique passwords for every website (the ideal defense against credential stuffing) is by delegating the memory task to a password manager (like Bitwarden or 1Password). The password manager generates and remembers a random 20-character password for every site; you only remember one strong master password.
Short Summary
All password cracking techniques are fundamentally based on the impossibility of mathematically reversing a cryptographic hash. Instead, crackers generate millions or billions of candidate passwords, hash each one, and compare against the target. Dictionary attacks exploit common human password choices using lists of real leaked passwords. Rule-based attacks apply systematic transformations to dictionary words to match complexity requirements. Brute force is effective only against very short passwords. Rainbow tables are defeated by unique salting. Against offline cracking of fast hash algorithms (like MD5), modern GPUs can make billions of attempts per second—making strong, purpose-built password hashing algorithms (like bcrypt and Argon2) critically important for any system storing user credentials.
Conclusion
Password cracking is one of the most revealing techniques in all of information security, because it exposes the uncomfortable gap between what users think is secure and what is actually secure in the face of modern computational power.
A password that feels strong—"Summer2024!"—can be cracked within seconds by an optimized dictionary + rule-based attack. True password security requires understanding the mechanics of these attacks and designing defenses that actually account for modern cracking capabilities.
For individuals: use a password manager, use unique passwords on every site, and enable MFA everywhere it is available. For developers: use bcrypt or Argon2, always salt your hashes, and consider the entire password lifecycle from storage to breach response.
