How Hackers Crack Passwords (and How to Stop Them)
An overview of credential stuffing, dictionary, brute-force and phishing attacks, and the specific defences that stop each one.
Understanding how attackers work makes it clear why some password advice matters and some does not. Most attacks fall into a few categories.
Online attacks
These are attempts against a live login page.
- Credential stuffing: automated logins using username and password pairs leaked from other breaches. It works because people reuse passwords.
- Password spraying: trying a handful of very common passwords, such as "123456" or "Welcome1", against many accounts to avoid lockouts.
Websites can rate-limit and lock accounts, so online attacks rely on predictable or reused passwords.
Offline attacks
When a company's database is breached, attackers may steal password hashes. They then guess passwords on their own hardware, with no rate limits.
- Dictionary attacks test huge lists of real leaked passwords and words, plus rules that add numbers, symbols and capitalization.
- Brute-force attacks try every combination, practical only for short passwords.
- Weak storage such as old, fast hashing algorithms or missing salts makes cracking much faster.
Social attacks
- Phishing tricks you into typing your password into a fake site.
- Malware such as keyloggers records what you type.
Defences that match each attack
| Attack | Best defense |
|---|---|
| Credential stuffing | A unique password for every site |
| Password spraying | Avoid common and seasonal passwords |
| Offline cracking | Long random passwords (16+ characters) |
| Phishing | Passkeys or app-based two-factor authentication; a password manager that only fills on the real site |
| Malware | Updated software, careful downloads, security software |
A random password generator plus a password manager handles the first three rows. Two-factor authentication and passkeys add a strong layer against the rest.
Frequently asked questions
How long to crack a password?
It depends on length, randomness and how the site stored it. A random 8-character password may fall within hours to days offline; a random 16-character password would take far longer than the age of the universe. Our generator shows a crack time estimate for your settings.
How to make a password harder to crack?
Add length, make it random and never reuse it. That is how to make a password harder to crack. Password guessing tools target words, names, dates and patterns, so a generated password defeats them.
What is hash cracking?
Hash cracking is guessing passwords offline against stolen password hashes. Attackers use GPUs and huge leaked lists. Slow hashing algorithms and long random passwords make hash cracking impractical. An online attack, by contrast, is limited by rate limiting and account lockout.
What are the most common passwords?
The most common passwords include 123456, password, qwerty, 111111 and simple variations. These are tried first in every attack. A weak password like these can be guessed in seconds.
Try the free Password Generator
Create strong random passwords with custom length, symbols and a live strength meter.
Open Password Generator