When a company admits "our password database was stolen", the passwords themselves are rarely what leaks — modern systems store scrambled fingerprints called hashes, not the passwords. Yet within days of a big breach, millions of the real passwords are somehow public. The bridge between those two facts is password cracking, and understanding it changes how you choose every password for the rest of your life. This article explains how cracking actually works, how fast it really is, and the handful of defences that make it practically impossible.

The short version

  • Attackers usually crack passwords offline, from a stolen hash database — no lockouts, no warnings, unlimited guesses.
  • Against fast hashes, a single gaming-grade GPU tries billions of guesses per second. Human-chosen passwords fall in minutes.
  • The attacks are mostly not brute force: leaked-password lists and predictable patterns ("Summer2026!") do the work.
  • Your defence is simple: long, unique passwords from a password manager, plus MFA or passkeys.

First, how passwords are stored

When you set a password, a well-built site runs it through a one-way hash function and stores the result. Logging in means hashing what you typed and comparing fingerprints — the site never needs your actual password. Good systems add a random salt per user and use deliberately slow hash functions (bcrypt, scrypt or Argon2) so each guess costs real time. Weak systems use fast hashes like MD5 or SHA-1, skip the salt, or — the unforgivable sin — store passwords in plain text.

Cracking is what happens after the hash database leaks: the attacker takes it home and guesses passwords on their own hardware, hashing each guess and comparing. No login page, no rate limit, no account lockout. The only question is how many guesses your password can survive.

The four attacks that do the damage

1. Credential stuffing — no cracking required

The laziest and most effective attack skips hashes entirely. Billions of email-and-password pairs from old breaches circulate in collections, and because people reuse passwords, attackers simply replay those pairs against other sites with automated tools. If your forum password from 2019 is also your email password today, no amount of cleverness in the password itself saves you. Uniqueness is the defence — which is why passkeys and password managers matter so much.

2. Dictionary attacks with rules

Attackers start from real leaked passwords — the famous rockyou list alone holds over 14 million — and then apply rules: capitalise the first letter, swap a→@ and o→0, append "123", "!" or the current year. These mangled dictionaries mirror exactly how humans invent "new" passwords, and they chew through most of them.

3. Brute force

Trying every combination works only against short passwords, but "short" keeps growing: against a fast unsalted hash, an 8-character password of any mix falls to a modern GPU rig quickly, because billions of attempts per second turn "94^8 combinations" into an afternoon's work. Length is the counter — every extra character multiplies the search space, which is why a 5-word passphrase beats "P@ssw0rd!" by astronomical margins.

4. Rainbow tables

Precomputed tables of hashes let attackers look up unsalted passwords almost instantly. Salting — one random value per user, mixed into the hash — kills this attack completely, which is why any breach headline mentioning "unsalted MD5" should make you change that password everywhere, immediately.

Why the hash algorithm decides everything

The same password can be uncrackable or trivial depending on how it was hashed. Fast hashes (MD5, SHA-1, NTLM) were designed for speed — exactly wrong for passwords. Slow, memory-hard algorithms (Argon2id, bcrypt at a proper cost factor, scrypt) cap an attacker at thousands of guesses per second instead of billions, and stretch an attack from hours to centuries. As a user you cannot choose a site's algorithm — but you can make your password long enough that even the fast-hash scenario fails, and stop reusing it so one site's bad choices cannot follow you.

Your defence checklist

  • Use a password manager. Let it generate 16+ character random passwords. You memorise one master passphrase; it remembers everything else.
  • Never reuse. Every account gets its own password, so a breach stays contained to one site.
  • Turn on MFA everywhere it exists — and prefer passkeys or an authenticator app over SMS codes, which fall to the phishing techniques in our anatomy of a phishing campaign.
  • Check your exposure. Services like Have I Been Pwned tell you which breaches your email appears in; anything listed gets a new, unique password.
  • Length beats cleverness. A passphrase of five random words is both stronger and easier to type than a short symbol salad.

If you run a website

The other side of this article is a short shopping list: hash with Argon2id or bcrypt, salt by default (the libraries do it), rate-limit and monitor login endpoints, screen new passwords against known breach lists, and offer MFA. Every item is cheap. The breach notification email is not.

Password cracking sits inside a bigger craft — hash attacks are one module of the password and post-exploitation tradecraft taught in our Ethical Hacking for Beginners course, where you crack hashes in a legal lab and then learn to defend against exactly what you did.