How Password Cracking Actually Works (and What It Means for You)
Most password advice makes more sense once you know how attackers actually recover passwords. This guide walks through the main attack types, the real speeds involved, and what each one means for how you should choose and store passwords — both as a user and as a developer.
Two very different situations: online and offline
Online guessing means the attacker types (or scripts) guesses into a real login form. Every guess is a network request the service can see, slow down, or block. Even a poorly protected site rarely allows more than a few hundred guesses per second, and a well-run one locks or throttles an account after a handful of failures. NIST requires services to limit failed attempts to no more than 100 per account before taking action.
Offline cracking happens after a breach. The attacker has a copy of the password database — ideally for you, password hashes rather than the passwords themselves — and can test guesses on their own hardware as fast as it will go, with no lockout and no one watching. The speed difference between these two situations is a factor of a billion or more, and it is the single most important idea in password security.
What a hash is, and why it slows attackers down
A well-built service never stores your password. It stores the output of a one-way function (a hash) and, at login, hashes what you typed and compares the results. An attacker who steals the database cannot run the hash backwards; they can only guess a password, hash it, and see if it matches. You can see how hashes behave with our hash generator: change one character of the input and the whole output changes.
Two details decide how hard that guessing is:
- Salt: a random value stored alongside each hash and mixed into it. Without salt, identical passwords produce identical hashes, so one guess tests every user at once and precomputed tables work. With a unique salt per user, each account has to be attacked separately.
- Speed of the hash: general-purpose hashes like MD5, SHA-1, and SHA-256 are designed to be fast, which is exactly wrong for passwords. Password hashing functions — bcrypt, scrypt, Argon2, PBKDF2 — are deliberately slow and, in the case of scrypt and Argon2, memory-hungry, so each guess costs the attacker real time and hardware.
Real cracking speeds
Published hashcat benchmarks for a single high-end consumer GPU (an NVIDIA RTX 4090) give a sense of the scale. Figures are approximate and vary with driver and hashcat version:
| Hash algorithm | Approximate guesses per second (one GPU) |
|---|---|
| NTLM (Windows) | ~290 billion |
| MD5 | ~160 billion |
| SHA-1 | ~50 billion |
| SHA-256 | ~22 billion |
| bcrypt, cost 5 | ~180,000 |
| bcrypt, cost 10 (common default) | ~5,700 (each +1 in cost halves this) |
The gap between an unsalted fast hash and bcrypt at a sensible cost is a factor of roughly 30 million. The same password can fall in an hour or hold for millennia depending on a decision made by the website’s developers — a decision you usually cannot see. That uncertainty is why it is worth using strong passwords everywhere, not only on sites you believe are well run.
Attackers don’t start with brute force
Trying every possible combination is the last resort. Real cracking sessions run roughly in this order, cheapest and most productive first:
- Known leaked passwords. Billions of real passwords from past breaches are publicly circulated. The first pass simply tries them. Any password you have ever used on a breached site, and any common password, falls here in seconds.
- Dictionary plus rules. Wordlists (words, names, places, sports teams, song lyrics) are combined with transformation rules that mimic human habits: capitalize the first letter, append a year or
!, swapafor@andofor0. This is whyP@ssw0rd2026!is weak despite containing every character type. - Masks. Attacks shaped like common structures, for example “one uppercase, five lowercase, two digits”. They search a small, high-probability slice of the full space.
- Brute force. Finally, every combination up to some length. At 160 billion MD5 guesses per second, every 8-character password from all 95 printable characters (about 6.6 × 1015 options) is exhausted in under 12 hours on one GPU.
A randomly generated password defeats steps 1–3 completely because it has no human pattern to exploit. Against step 4 its strength is exactly its entropy, which we explain in password entropy explained.
Credential stuffing: no cracking required
The most common way accounts are taken over today does not involve cracking at all. Attackers take username and password pairs leaked from one site and replay them automatically against many others: email, banking, shopping, streaming. If you reuse a password, its strength is irrelevant — it is already known. Unique passwords per site are the defense, and a password manager is the only realistic way to have them.
What this means for you as a user
- Use a unique password for every account. This alone defeats credential stuffing.
- Make them random and long. 14–16 characters from our password generator survive even a fast unsalted hash on large GPU clusters.
- Turn on multi-factor authentication for email, banking, and anything that can reset other accounts. A cracked password alone is then not enough.
- Change a password when a service reports a breach, not on an arbitrary schedule.
What this means for you as a developer
- Never use MD5, SHA-1, or plain SHA-256 for passwords, even with salt. Use Argon2id, scrypt, bcrypt, or PBKDF2 with parameters tuned so one verification takes a noticeable fraction of a second on your servers.
- Generate a unique random salt per password. Modern libraries do this for you; don’t roll your own.
- Rate-limit and monitor login attempts so online guessing stays slow.
- Check new passwords against a breach list and reject the ones attackers try first. Our guide to the NIST password guidelines covers this and the other requirements.
Key takeaways
- Offline cracking after a breach is billions of times faster than guessing through a login form.
- Attackers try leaked passwords and human patterns long before brute force; random passwords skip straight to the hardest case.
- Password reuse makes strength irrelevant. Unique passwords plus MFA stop the most common attacks.