How Passwords Are Hacked — And How to Stop It

The popular picture of password hacking is someone typing guesses into a login box. Much of the real damage happens elsewhere: passwords are lifted from a stolen database, matched against lists leaked from other services, or handed over to a fake web page. Understanding how passwords are hacked in each of those ways explains why some defenses work and others only feel safe. The sections below follow each attack in order, with measured cracking speeds for the offline cases, then cover what current NIST guidance, password managers, and passkeys actually change.

Two ways in: guessing at the door, or cracking a stolen file

Think of a nightclub with a bouncer and a guest list. You can walk up and try names until one works, but the bouncer notices after a few wrong tries and stops answering. That is an online attack. Every guess goes through the site's login form, so the site can slow it down, lock the account, or raise an alert. The standard brake is rate limiting, which caps how many requests one client can make in a given window, and how rate limiting protects APIs shows how a server enforces it.

Now suppose someone photocopies the guest list instead and takes it home. No bouncer exists there, so they can try names as fast as their equipment allows. That is an offline attack, and it is the case most of this article is about. It starts with a breach: the attacker copies a database of stored password hashes, then tests guesses against the copy with no rate limit, no lockout, and no notice to the site.

The distinction explains a common surprise. A short password can be adequate against an online attacker who gets a handful of tries and hopeless against an offline attacker who gets billions. After a breach, the site's storage choices decide which of those two worlds your password lives in.

A third route skips guessing altogether. Credentials that leaked from one service get tried on another (credential stuffing), or a user types the password into a fake page (phishing). Verizon's 2025 Data Breach Investigations Report analyzed more than 22,000 security incidents, including 12,195 confirmed data breaches, and lists credential abuse at 22 percent and exploitation of vulnerabilities at 20 percent as the two leading initial access vectors (Verizon). Stolen or reused credentials are, in other words, one of the two most common ways into an organization.

How a site stores your password, and why a hash is not encryption

A well-run site never keeps your password. It keeps a hash, the output of a one-way function. Picture a sausage grinder: pork goes in, sausage comes out, and nobody can push the sausage back through to recover the pork. Feed the grinder the same pork twice and you get identical sausage, which is what lets a site check a login. When you sign in, the site grinds what you typed and compares the result with the stored value.

SHA-256, for example, turns any input into a 256-bit value, usually written as 64 hexadecimal characters. MD5 produces a shorter 128-bit value, written as 32 characters. The MD5 hash of the string password123 is always 482c811da5d5b4bc6d497ffa98491e38, on any machine, for any user. That determinism is both the feature and the weakness. An attacker who holds the hash can hash candidate passwords until one matches.

Hashing and encryption are different tools, and confusing them has cost real companies dearly. Encryption is reversible by anyone holding the key. Adobe's October 2013 breach exposed about 153 million records, each with an email address, username, encrypted password, and a plain-text password hint (Have I Been Pwned). The encryption was poorly implemented, many passwords were quickly reversed to plain text, and the unencrypted hints revealed much about the rest. For the broader mechanics of keys and ciphers, how encryption works covers the difference in detail.

Plain-text storage is worse still. RockYou, a company that built applications for social networks, kept more than 32 million user accounts in an unencrypted database, plaintext passwords included, and it leaked in 2009 (Wikipedia). The full list was posted online and became a standard ingredient in cracking tools, a point that returns below.

There is one more property that matters here: speed. MD5, SHA-1, and SHA-256 were designed to digest large files quickly, which is a virtue for verifying a download. For storing passwords it is a defect, because it hands the attacker the same speed.

How many guesses per second can one graphics card make?

Speed is not abstract. Hashcat, a widely used open-source password-recovery tool, ships a built-in benchmark mode. One forum user posted results for a single NVIDIA RTX 4090 graphics card running hashcat v6.2.6 on December 29, 2022 (hashcat forum). The numbers show how much the choice of algorithm matters.

Hash algorithm	Speed on one RTX 4090	Guesses per second (rounded)
MD5	149.8 GH/s	about 150 billion
SHA-1	48,903.9 MH/s	about 49 billion
SHA-256	21,188.1 MH/s	about 21 billion
bcrypt, 32 iterations (cost 5)	185.1 kH/s	about 185,000

Source: hashcat forum benchmark, December 29, 2022. GH/s means billions of hashes per second, MH/s millions, kH/s thousands. The benchmark's bcrypt run used 32 iterations, which corresponds to a cost factor of 5.

bcrypt's cost factor is a dial. Each increase of one doubles the work, so cost 12 is 2^7, or 128 times, slower than cost 5. Dividing the benchmark rate by 128 gives an estimated 1,400 or so guesses per second at cost 12. That is an estimate derived from the benchmark, not a measured figure, but it is enough to compare MD5 with a well-tuned slow hash: roughly 100 million times fewer guesses per second on the same card.

The next table turns those speeds into time. It divides the number of possible passwords by each rate, assuming the attacker must try every candidate (the worst case for the attacker) and uses one card. The times are derived estimates, not measurements.

Password type	Candidates	MD5	SHA-256	bcrypt cost 5	bcrypt cost 12 (est.)
8 random lowercase letters	about 2.1 × 10^11	1.4 seconds	9.9 seconds	13 days	4.6 years
8 random characters from all 95 printable ASCII	about 6.6 × 10^15	12.3 hours	3.6 days	1,136 years	about 145,000 years

Two caveats keep this honest. First, the scaling is linear: an attacker renting 1,000 cards finishes 1,000 times sooner, which turns the 4.6 years above into a couple of days. Second, humans do not pick passwords uniformly at random, so real attacks do not search in this order. They search the likeliest passwords first, which the next two sections explain.

Rainbow tables, salt, and why identical passwords should not look identical

If a site hashes every password the same way, an attacker can do the expensive work once and reuse it. That is the idea behind precomputed tables. In 1980, Martin Hellman described a time-memory trade-off that stores partial results to cut cracking time, and in 2003 Philippe Oechslin refined it into what are now called rainbow tables (Oechslin, CRYPTO 2003). Think of an answer key for a standardized test. Writing it takes effort, but grading each paper afterward takes seconds. A rainbow table stores compact chains of hashes rather than every pair, and rebuilds the missing links on demand.

The effect was dramatic for fast, unsalted hashes. Oechslin's paper reports cracking 99.9 percent of alphanumeric Windows password hashes in 13.6 seconds using 1.4 GB of precomputed data. A table like that works against any user whose password hash was made the same way, because the same input always produces the same output.

Salting breaks that reuse. A salt is a random value generated for each password and combined with it before hashing. OWASP's Password Storage Cheat Sheet says each password gets its own random salt, which defeats precomputed lookup tables and stops an attacker from spotting identical passwords across users (OWASP). The salt is not secret. It sits in the database next to the hash. Its job is to force the attacker to treat each account as a separate puzzle rather than cracking the whole table at once.

The cost of skipping salt is on record. LinkedIn's 2012 breach initially exposed about 6.5 million password hashes, and in 2016 a data set with roughly 117 million email and password pairs surfaced. The passwords were stored as unsalted SHA-1 hashes, and Motherboard reported that about 90 percent of the new set was cracked within 72 hours (TechCrunch). That 90 percent figure is a press report rather than an audited result, but it matches what the arithmetic above predicts for a fast hash with no salt.

Salt has limits worth stating plainly. It does not slow a determined attack on one specific account, because the attacker only needs to hash guesses with that account's salt. What it removes is economies of scale. Slowing each individual guess is the job of the next layer, covered in the section on what site operators can do.

Dictionary attacks: how human passwords actually fall

Rather than trying every possible string, attackers try the likeliest ones first. A dictionary attack runs through a wordlist of common passwords, names, and phrases, hashing each entry and comparing it with the stolen hashes. The best wordlists come from earlier breaches, since real people created those passwords. The 2009 RockYou leak became the classic example: a list of real passwords that anyone could download.

A bigger collection appeared in June 2021, when a forum user posted a 100 GB file called RockYou2021 and claimed it held 82 billion passwords. Cybernews counted 8,459,060,239 unique entries, and described it as presumably combined from earlier leaks, including the 3.2 billion passwords in the COMB compilation (Security Affairs). Some security vendors argued it added little risk beyond what earlier lists already offered, which is plausible, since a list of recycled passwords mostly re-adds recycled passwords.

Wordlists get multiplied by rules. Hashcat's rule engine is a tiny language that changes, removes, or adds characters to each candidate. Its documentation gives the example c sa@ $1, which capitalizes the first letter, swaps each "a" for "@", and appends a "1", turning password into P@ssword1 (hashcat wiki). Those three steps model exactly what people do when a site demands an uppercase letter, a symbol, and a number.

That is why composition rules disappointed. Forcing "at least one capital, one digit, and one symbol" does not add much randomness, because people satisfy the rule in the same few ways. A password like Summer2024! meets every checkbox and sits within the reach of a basic ruleset.

Published "time to crack" charts vary widely for this reason. Hive Systems, a security firm, said in its April 2025 release that an eight-character password of only lowercase letters can be cracked in three weeks, using consumer-grade GPUs (Hive Systems). The estimate in the table above for the same password against MD5 is about a second. The gap is not a contradiction. Such figures depend on which hash the site uses, how many cards the attacker has, and what the attacker assumes about the password, so always check the assumptions before comparing numbers.

Credential stuffing and phishing: attacks that skip the cracking

Some attacks never touch a hash. Credential stuffing takes usernames and passwords exposed in one breach and tests them automatically against other sites. OWASP describes the steps: obtain credentials from a breach, phishing, or a dump site, use automated tools to try them across many sites, and keep whatever works (OWASP). It works because people reuse passwords, the digital version of using one key for the house, the car, and the office. Lose that key anywhere and everything opens.

In April 2020, researchers bought about 530,000 Zoom accounts that were being offered on hacker forums for roughly US$0.002 each. They attributed the credentials to credential stuffing rather than a breach of Zoom's own systems, and said some passwords came from older breaches (WeLiveSecurity). The lesson is that a company can have sound security and still have customer accounts taken over.

Not every large account takeover is stuffing, though. In June 2020, Nintendo raised its count of affected accounts to 300,000, up from 160,000. Nintendo said it was not a credential stuffing attack and that the attackers had abused the integration with its legacy Nintendo Network ID system (Security Affairs). Attributing a takeover correctly matters, because the fix depends on the cause.

You can check whether a password has appeared in known leaks without revealing it. Have I Been Pwned's Pwned Passwords service uses a k-anonymity range search: your device sends only the first five characters of the password's SHA-1 hash, and the service returns every matching suffix, an average of 478 per query, so it cannot tell which one you were checking. The corpus held 501,636,842 unique passwords when version 2 launched (Troy Hunt).

Phishing needs no technical sophistication either. A convincing message sends you to a lookalike login page, and you type the password into the attacker's server. Keyloggers, malware that records keystrokes, capture passwords before any hashing happens. In the 2022 LastPass breach, an attacker compromised a senior DevOps engineer's personal computer through an unpatched media server, installed a keystroke logger, and captured the engineer's master password, which led to the theft of backups containing customers' encrypted vaults (Wikipedia). A better password hash would not have helped there. Different defenses address different attacks, and the next sections sort out which is which.

What site operators can do: slow, salted, memory-hungry hashes

The fix for fast hashes is to make each guess expensive on purpose. bcrypt, introduced by Niels Provos and David Mazières at the 1999 USENIX Annual Technical Conference, builds in a tunable cost factor. Their central argument was that the cost of a secure password scheme must rise as hardware gets faster (USENIX). A login takes a fraction of a second longer, which no user notices, while an attacker's guesses per second collapse, as the benchmark table showed.

Newer designs add a second kind of cost: memory. Argon2 won the Password Hashing Competition, which ran from 2013 to 2015 and drew 24 candidates, with the winner announced in July 2015 (Password Hashing Competition). It is described in RFC 9106, published in September 2021, which makes Argon2id the primary variant (IETF). Forcing each guess to fill a block of memory hurts attackers who run thousands of guesses in parallel on a GPU or custom chip, because the memory has to be there for every simultaneous guess.

OWASP publishes concrete starting settings, summarized below. They are minimums to tune upward, not universal answers.

Algorithm	OWASP minimum configuration	Note
Argon2id (preferred)	19 MiB memory, 2 iterations, 1 degree of parallelism	Equivalent trade-offs exist, for example 46 MiB with 1 iteration
scrypt	N = 2^17 (128 MiB), r = 8, p = 1	When Argon2id is unavailable
bcrypt	Work factor of at least 10	Legacy systems; inputs limited to 72 bytes in most implementations
PBKDF2-HMAC-SHA256	600,000 iterations	When FIPS-140 compliance is required

Source: OWASP Password Storage Cheat Sheet.

OWASP also describes a pepper: a secret value shared across stored passwords, kept in a secrets vault or hardware security module rather than in the database. It helps if an attacker steals only the database, but OWASP treats it as defense in depth, since it adds no security on its own. For anyone building a login system, the practical advice is to use a vetted library, accept long passwords, and never invent a scheme.

What you can do: length, a manager, and a second factor

You cannot control how a site stores your password, so the strategy is to limit the damage when one fails. Three habits cover most of the ground: a unique password per site, enough length that guessing is impractical, and a second factor that survives password theft.

NIST's current guidance reflects this. SP 800-63B-4, published in July 2025, requires at least 15 characters when a password is the only authentication factor and allows at least 8 when it is used alongside another factor. It says services should allow at least 64 characters, must not impose composition rules, must not force periodic changes unless there is evidence of compromise, must check new passwords against lists of breached and common values, must allow password managers and autofill, and should allow pasting (NIST SP 800-63B-4, NIST CSRC). Forced rotation and symbol rules, once standard, are now officially discouraged.

A password manager makes uniqueness practical. It generates a random password for each site and fills it in, so reuse stops being a temptation and credential stuffing from an old breach finds nothing to match. Managers are not magic, and the LastPass case shows why. Vaults stolen in 2022 were encrypted with keys derived from each user's master password, so their safety depends on how strong that master password is and on how many key-derivation rounds were used. Researchers later linked more than 150 victims, with over $35 million in losses, to offline decryption of stolen vaults (Wikipedia). A long, unique master password matters more than anything else you put in the vault.

Second factors differ a great deal in strength:

Second factor	What an attacker needs	Main weakness
SMS code	Control of your phone number	SIM swapping: an attacker convinces a carrier to move your number to their SIM
Authenticator app code	A live code from your device	Codes can be typed into a fake site, which can pass them on in real time
Passkey or hardware security key	Your physical device plus your unlock	Support varies by site, and recovery depends on whether the passkey is synced or device-bound

SIM swapping works by impersonating you to your mobile carrier, after which texts and password-reset messages go to the attacker. Authenticator apps and hardware keys avoid that because they do not depend on your phone number.

Passkeys go further by removing the shared secret. According to the FIDO Alliance, a passkey is a cryptographic key pair whose private key stays on your device, each one is tied to a single site or app so a fake site cannot use it, and unlocking is done locally with a biometric, PIN, or pattern (FIDO Alliance). There is nothing for a server breach to leak that works elsewhere, and nothing for a phishing page to capture. For how they work and where they live, see how passkeys replace passwords. A May 2024 FIDO Alliance survey of about 2,000 people in the U.S. and U.K. found 53 percent had enabled passkeys on at least one account, and later FIDO surveys report higher shares (FIDO Alliance).

Common myths about password security

"Complexity beats length." Not by the arithmetic above. For a random password, each extra character multiplies the search space, and NIST's current rules set the floor in characters, not character types. A long passphrase of unrelated words you will actually remember can beat a short string of symbols you will not.

"Change it every 90 days." Forced rotation tends to produce small, predictable edits such as Summer1 to Summer2, which is exactly what rule-based cracking guesses. NIST's SP 800-63B-4 prohibits periodic changes and calls for a forced change only when there is evidence the password is compromised.

"A hacker has to guess my password." Often the attacker never guesses. They reuse it from a previous breach, capture it with a fake page, or read it off a keylogger. Strong passwords do nothing against the last two, which is why a second factor matters.

"Quantum computers will crack my password." The best-known quantum threat targets public-key schemes such as RSA. For brute-force search, the main quantum technique, Grover's algorithm, offers at most a square-root speedup. Current worries are better spent on reuse and phishing than on hypothetical machines. For the public-key side of that debate, see what if quantum computers broke all modern encryption.

"If I am in a breach, my password is public." Not necessarily. A site that stored salted slow hashes leaks values that are costly to reverse, while a site that stored fast unsalted hashes, as LinkedIn did, leaks values that fall quickly. Your risk depends partly on decisions you never saw. When a service you use discloses a breach, the sensible response is to change that password and every other place you used it. More background on how large-scale threats play out is in cybersecurity threats in 2026 and the practical how to protect your online privacy in 2026.

The takeaway

Passwords fail in predictable ways, and each failure has a matching defense that someone controls. Fast, unsalted hashes lose to a single graphics card in seconds. Slow, salted, memory-hard hashes push the same attack out to centuries, but only the site operator can choose them. Reuse turns one breach into many, which only unique passwords prevent. Phishing and keyloggers bypass the hash altogether, and only phishing-resistant factors such as passkeys stop them. The useful question is never whether your password is clever. It is which of these attacks your setup survives, and for most people the answer improves most by using a manager, a long unique password where a manager cannot help, and a passkey wherever one is offered.

FAQ

Q: Is my password in a breach? A: You can check at Have I Been Pwned, which indexes exposed credentials, and its Pwned Passwords tool checks a password without sending it in full. If an account of yours appears in a breach, change that password and any other place you reused it.

Q: How long should a password be? A: NIST SP 800-63B-4 requires at least 15 characters when a password is the only factor and at least 8 when it is combined with another factor, and says services should accept at least 64. Length helps because every extra random character multiplies the number of guesses an attacker needs, as the tables above show.

Q: Is SMS two-factor authentication safe? A: It is better than a password alone, but SIM swapping lets an attacker redirect your text messages by convincing a carrier to move your number. Authenticator apps and hardware keys do not depend on your phone number, and passkeys are designed to resist phishing as well.

Q: Why do some websites have complexity rules but no minimum length? A: Composition rules were once common advice, but people satisfy them in predictable ways, such as capitalizing the first letter and adding a number and symbol at the end. NIST SP 800-63B-4 now says services must not impose composition rules and must check passwords against lists of breached and common values.

Q: Can quantum computers crack passwords? A: Quantum computing's best-known threat is to public-key cryptography such as RSA. For brute-forcing a hash, the main quantum technique, Grover's algorithm, gives a quadratic speedup at most, so slow, salted hashes remain a sound defense. Reuse, phishing, and weak storage are the more immediate risks.

Q: What is a passkey, and should I use one? A: A passkey is a cryptographic key pair whose private key stays on your device, tied to a single site so a fake page cannot use it, according to the FIDO Alliance. Because no shared secret sits on a server, a breach leaks nothing that works elsewhere. Where a site offers one, it generally removes the biggest weaknesses of passwords.

Q: Does a password manager make me a bigger target? A: Managers concentrate risk in one place, and the 2022 LastPass breach showed stolen vaults can be attacked offline when the master password is weak. The trade-off is that unique random passwords stop credential stuffing. A long unique master password and a second factor on the manager account address the concentration.

Sources

• Verizon, 2025 Data Breach Investigations Report news release
• OWASP, Password Storage Cheat Sheet
• NIST, SP 800-63B-4, Authentication and Authenticator Management and publication record
• FIDO Alliance, Passkeys
• Provos and Mazières, A Future-Adaptable Password Scheme, USENIX 1999
• Oechslin, Making a Faster Cryptanalytic Time-Memory Trade-Off, CRYPTO 2003
• IETF, RFC 9106: Argon2

---

Read next:

• How Cloud Computing Works: The Infrastructure Behind Everything
• How Facial Recognition Works: The Technology Changing Surveillance Forever
• How Ransomware Works: The Cybercrime That Shuts Down Hospitals