Movies show hackers typing furiously until a password appears. Real attacks are automated, patient and built on knowledge of human habits. This explainer is part of our guide to data breaches and hacked accounts.
Online vs offline attacks
There are two very different settings:
| Type | How it works | Speed |
|---|---|---|
| Online | Trying logins on a real website | Slow, can be blocked |
| Offline | Guessing against stolen hashes on the attacker's own hardware | Billions of guesses a second against weak hashes |
Most serious cracking is offline, after a data breach. That is why length matters, even if a site locks you out after a few wrong tries.
The methods, in the order attackers use them
1. Leaked passwords
Attackers start with lists of real passwords from past breaches, because people reuse them. This is the cheapest way in.
2. Dictionary attacks
Next come dictionaries of words, names, places, sports teams and pop culture, in many languages.
3. Rules and patterns
Tools then apply the changes that people make: capitals at the start, numbers at the end, @ for a, 0 for o, years and exclamation marks. This is why complexity alone does not help. See what makes a password weak.
4. Targeted guessing
If someone is after you personally, they add your name, children, pets, birthday and street. Social media makes this easy.
5. Brute force
Finally, attackers try every possible combination. This works for short passwords but becomes impractical as length grows. That is what we show in how long a password should be.
What slows them down
Sites can store passwords with slow hashing methods, designed to make each guess expensive. You cannot see how a site does this, so plan for the worst.
What actually protects you
- Long random passwords from a generator, which defeat all of the above.
- Passphrases of random words, as long as they are truly random.
- Unique passwords, so a cracked password opens only one door.
- Two-factor login, so that a cracked password alone is not enough.
If you are curious about the maths, password strength explained covers how to measure a password.