How Passwords Get Cracked: Attacks and Defenses

Published November 8, 2026 · 7 min read · By KeyGuard Pro

When a password is "cracked", it rarely means somebody sat at a login screen trying combinations. Most real attacks use stolen data, leaked lists or tricked users. Understanding the main methods shows why certain habits matter far more than others.

Online guessing

In an online attack, the attacker submits guesses to the real login page. This is slow, and most services slow it further with rate limits, CAPTCHAs and temporary lockouts. Online guessing works mainly against very weak passwords such as "123456" or "password", and against accounts with no limits at all.

A variant called password spraying tries a few very common passwords against thousands of accounts, staying under per-account limits. It succeeds because some accounts, out of many, always use a weak password.

Credential stuffing

Credential stuffing is the most common and most damaging attack for ordinary people. When one website is breached, attackers collect the email and password pairs and automatically try them on banks, shops, email providers and social networks. If you used the same password in two places, a breach at the weaker site opens the stronger one.

The only reliable defense is a different password for every account. The strength of the password does not matter if it is shared with a site that leaks it.

Offline cracking after a breach

When a site's database is stolen, it should not contain your actual password. Well-built sites store a hash: the output of a one-way function. To check a login, the site hashes what you typed and compares the result. Attackers who steal the database cannot reverse the hash, so they guess passwords, hash each guess, and look for a match, entirely on their own computers without limits.

How fast that goes depends on the hash:

• Fast general-purpose hashes such as MD5 or SHA-1 were designed for speed. Modern graphics cards can test billions of guesses per second against them.
• Slow password hashes such as bcrypt, scrypt and Argon2 are deliberately expensive in time and memory. Argon2 won an open Password Hashing Competition in 2015. Against these, the same hardware manages only thousands or fewer guesses per second.
• Salting adds a unique random value to each password before hashing, so identical passwords produce different hashes and attackers cannot crack everybody at once with a precomputed table.

You cannot see how a site stores passwords, so you should assume the worst. A long, random password survives even a fast hash.

Dictionary and rule-based attacks

Cracking software does not try combinations in order. It starts with lists of leaked passwords and common words, then applies rules that mimic human habits: capitalize the first letter, append digits or a year, replace "e" with "3", add "!" at the end. A password such as "Tr0ub4dor&3" feels complex but follows these patterns, which is why length and true randomness matter more than looks.

Brute force

True brute force tries every possible combination up to a given length. It is the last resort, and it is only practical against short passwords. Every extra random character multiplies the work by the size of the character set. That is the basis of the figures in our entropy guide.

Phishing and malware

No password can protect you if you type it into a fake page or if software on your device records your keystrokes. Phishing messages imitate your bank, your email provider or an employer, and send you to a page that looks genuine. Keyloggers and information-stealing malware capture passwords at the source.

Defenses here are different from the ones above: check the address before you sign in, keep your system and browser updated, avoid installing software from unofficial sources, and use two-factor authentication or passkeys, which an attacker cannot reuse even if they capture your password.

Shoulder surfing and guessing from personal information

Low-tech attacks remain common. Someone who knows your pet's name, your birthday or your street can guess a weak password without any software. Security questions with answers found on social media create the same weakness. Treat answers to security questions like passwords: generate random ones and store them in your manager.

What actually protects you

1. A unique, random password for every account.
2. Length: 14 or more characters for most accounts, more for important ones.
3. Two-factor authentication or passkeys on email, banking and your password manager.
4. A password manager to make the first three practical.
5. Prompt action after a breach, described in our guide on what to do after a data breach.