How Hackers Crack Passwords

The assumption attackers start with

Almost no attacker tries to break into a specific account by guessing its password from scratch. Instead, modern password attacks start with data — billions of previously leaked passwords, information about the target, or systematic generation of plausible candidates. The goal is not to guess in the dark but to exploit the statistical predictability of how humans choose passwords.

Dictionary attacks: the first pass

A dictionary attack uses a wordlist of known passwords and common words. The most widely used wordlist, Rockyou, was originally a leak of about 32 million passwords from a 2009 breach. Rockyou2024, published in 2024, compiles almost 10 billion leaked passwords. Dictionary attacks test these entries and common transformations: capitalising the first letter, adding digits at the end, substituting letters with numbers (e→3, a→@, i→1). Tools like Hashcat can apply thousands of transformation rules to each dictionary word automatically, generating thousands of candidates per wordlist entry.

Brute force: systematic enumeration

Brute force generates and tests every possible combination of characters up to a given length. For short passwords it is feasible: all lowercase 8-character passwords total 26⁸ = 209 billion combinations. Against fast, unsalted hashes such as MD5, a modern multi-GPU rig can test on the order of 300 billion guesses per second — meaning all 8-character lowercase passwords are exhausted in a few seconds at most. Adding uppercase, digits and symbols increases the space to ~95⁸ = 6.6 quadrillion, which takes several hours at that rate. Slow hashes such as bcrypt or Argon2 reduce the guess rate by orders of magnitude. The exponential growth with length is why 16+ character random passwords are safe from brute force on any plausible near-future hardware.

Rainbow tables: precomputed lookups

Rainbow tables are enormous precomputed databases that map hash values back to the passwords that produced them. They make cracking unsalted hashes very fast — a lookup replaces billions of guesses, at the cost of large storage. Salting (adding a random value to each password before hashing) makes rainbow tables ineffective: each salt requires its own table, and the number of possible salts makes precomputation infeasible.

Credential stuffing: using existing breaches

Credential stuffing does not crack passwords at all — it uses already-known username/password pairs from previous breaches and tests them against other sites. With billions of leaked credentials in circulation, this is one of the most common paths to account compromise. A 2025 Cloudflare analysis of traffic from late 2024 found that 41% of successful human logins involved credentials already leaked in a breach, and that about 95% of login attempts using leaked passwords came from bots. This attack works exclusively because of password reuse.

Phishing: bypassing cryptography entirely

If an attacker can convince you to type your password into a fake website, no hashing, salting or length requirement helps. Phishing does not attack the cryptography — it attacks the human. Spear-phishing attacks targeted at specific individuals combine social engineering with lookalike domains. MFA prompt fatigue attacks repeatedly push authentication requests until the target accepts one. Phishing is responsible for a significant portion of account takeovers, particularly for high-value targets in business environments.

What actually stops all of these attacks

Against dictionary attacks and brute force: a long, random password (16+ characters from a generator) has no patterns for a wordlist to match and too many combinations for brute force. Against rainbow tables: any modern password hashing system with salting makes them irrelevant. Against credential stuffing: a unique password per account means a breached password on Site A is useless on Site B. Against phishing: passkeys or hardware security keys with domain binding make even a successfully phished session useless. The practical minimum for 2026 is a 16+ character random password unique to each account, stored in a password manager, with MFA enabled on every account that supports it.

Password spraying: few guesses, many accounts

Password spraying inverts the usual approach. Instead of trying many passwords against one account, which triggers lockouts, the attacker tries a handful of very common passwords across thousands of accounts. It works whenever even a small share of users picks something predictable. The defences are the same ones that stop dictionary attacks: a unique, randomly generated password that appears on no common list, plus multi-factor authentication so that a correct guess alone is not enough.